# CloudFormation Stack Reference

The AllCode Nexus CloudFormation stack deploys the minimum required infrastructure in your AWS account to enable federated Claude Code access through Amazon Bedrock.

## What Gets Deployed

### Core Resources (Always Created)

| Resource | Type | Purpose |
|----------|------|---------|
| IAM OIDC Provider | `AWS::IAM::OIDCProvider` | Trusts your identity provider for federated authentication |
| Bedrock Access Role | `AWS::IAM::Role` | Assumed by authenticated users to invoke Bedrock models |
| Bedrock Access Policy | `AWS::IAM::Policy` | Scopes permissions to Bedrock model invocation only |
| Cognito Identity Pool | `AWS::Cognito::IdentityPool` | Maps OIDC tokens to temporary AWS credentials |

### Optional Resources (Monitoring Enabled)

| Resource | Type | Purpose |
|----------|------|---------|
| CloudWatch Dashboard | `AWS::CloudWatch::Dashboard` | Real-time usage visualization |
| Metrics IAM Policy | `AWS::IAM::Policy` | Allows credential helper to publish usage metrics |

## Stack Parameters

| Parameter | Required | Default | Description |
|-----------|----------|---------|-------------|
| `OIDCIssuerURL` | Yes | — | Your identity provider's issuer URL |
| `OIDCClientID` | Yes | — | Application client ID from your IdP |
| `OIDCAudience` | No | Same as Client ID | Token audience claim (if different from Client ID) |
| `BedrockRegions` | No | Stack region | Comma-separated list of regions to allow Bedrock access |
| `EnableMonitoring` | No | `false` | Deploy CloudWatch dashboard and metrics publishing |
| `AllowedModels` | No | All Claude models | Restrict access to specific model IDs |
| `NexusOrgID` | Yes | Auto-filled | Your Nexus organization identifier (provided by portal) |

## IAM Permissions Detail

The Bedrock Access Role has the following trust and permission boundaries:

**Trust Policy:**
- Only your configured OIDC provider can assume this role
- Condition restricts to your specific Client ID audience
- No other AWS accounts or services can assume this role

**Permissions Policy:**
```json
{
  "Effect": "Allow",
  "Action": [
    "bedrock:InvokeModel",
    "bedrock:InvokeModelWithResponseStream"
  ],
  "Resource": "arn:aws:bedrock:*::foundation-model/anthropic.*"
}
```

When monitoring is enabled, an additional statement allows:
```json
{
  "Effect": "Allow",
  "Action": [
    "cloudwatch:PutMetricData"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "cloudwatch:namespace": "AllCodeNexus"
    }
  }
}
```

## Deploying the Stack

### From the Nexus Portal (Recommended)

1. Go to **Settings** → **Deployment**
2. Click **Deploy Stack**
3. Fill in parameters
4. Click **Deploy**

The portal launches the stack directly in your account via a CloudFormation quick-create link.

### Manual Deployment

1. Download the template from **Settings** → **Deployment** → **Download Template**
2. Open the [AWS CloudFormation Console](https://console.aws.amazon.com/cloudformation)
3. Click **Create stack** → **With new resources (standard)**
4. Upload the template file
5. Enter the parameters
6. Acknowledge IAM resource creation
7. Click **Create stack**

## Updating the Stack

When AllCode Nexus releases infrastructure updates (e.g., new model support, security patches):

1. The Nexus portal will show an **Update Available** banner
2. Go to **Settings** → **Deployment**
3. Click **Update Stack**
4. Review the changeset summary
5. Click **Apply Update**

Or manually:

1. Download the updated template from the portal
2. In the CloudFormation console, select your stack
3. Click **Update** → **Replace current template**
4. Upload the new template and complete the wizard

Updates use CloudFormation changesets and will not disrupt active user sessions.

## Deleting the Stack

To remove all Nexus resources from your AWS account:

1. Open the [AWS CloudFormation Console](https://console.aws.amazon.com/cloudformation)
2. Select the `AllCodeNexus` stack
3. Click **Delete**
4. Confirm deletion

All IAM roles, policies, and the Cognito Identity Pool will be removed. Active user sessions will be terminated.

**Note:** Deleting the stack does not cancel your AWS Marketplace subscription. To cancel billing, unsubscribe from the Marketplace listing separately.

## Stack Outputs

After deployment, the stack exports these values (also visible in the Nexus portal):

| Output | Description |
|--------|-------------|
| `BedrockRoleARN` | ARN of the IAM role for Bedrock access |
| `IdentityPoolID` | Cognito Identity Pool identifier |
| `OIDCProviderARN` | ARN of the IAM OIDC Provider |
| `StackVersion` | Template version for update tracking |

## Multi-Region Support

To enable Bedrock access in multiple regions, set the `BedrockRegions` parameter to a comma-separated list:

```
us-east-1,us-west-2,eu-west-1
```

The IAM policy will scope Bedrock permissions to only the specified regions.

## Next Steps

- [Configure Your Identity Provider](./oidc-setup.md)
- [Review Security Posture](./security.md)
- [Set Up Quota Policies](./quota-policies.md)