# Deployment Guide

Deploy AllCode Nexus in your AWS account to provide your organization with managed Claude Code access through Amazon Bedrock.

## Prerequisites

- Active AWS account with CloudFormation and IAM permissions
- Amazon Bedrock enabled in your target region
- OIDC identity provider (Okta, Azure AD, or Auth0)
- AllCode Nexus subscription via AWS Marketplace

## Step 1: Subscribe on AWS Marketplace

1. Navigate to the [AllCode Nexus listing](https://aws.amazon.com/marketplace) on AWS Marketplace
2. Click **Subscribe**
3. Accept the terms and pricing
4. Once your subscription is active, click **Set Up Your Account** to be redirected to the Nexus portal

## Step 2: Log Into the Nexus Portal

1. Go to [nexus.allcode.com](https://nexus.allcode.com)
2. Sign in with the email associated with your AWS Marketplace subscription
3. Complete your organization profile if this is your first login

## Step 3: Deploy the CloudFormation Stack

From the Nexus portal:

1. Navigate to **Settings** → **Deployment**
2. Click **Deploy Stack**
3. Enter the required parameters:
   - **AWS Account ID** — The account where resources will be created
   - **Region** — AWS region for deployment (must have Bedrock enabled)
   - **OIDC Issuer URL** — Your identity provider's issuer URL
   - **OIDC Client ID** — The application client ID from your IdP
   - **Monitoring** — Enable or disable usage monitoring (optional)
4. Click **Deploy** to launch the stack directly, or click **Download Template** to deploy manually via the AWS Console

If deploying manually:

1. Open the AWS CloudFormation console in your target region
2. Click **Create stack** → **With new resources (standard)**
3. Upload the downloaded template
4. Fill in the parameters and complete the wizard

## Step 4: Wait for Stack Completion

Stack deployment typically takes 3–5 minutes. You can monitor progress:

- In the Nexus portal under **Settings** → **Deployment Status**
- In the AWS CloudFormation console under **Stacks** → **Events**

The stack status will show **CREATE_COMPLETE** when finished.

## Step 5: Verify Deployment

1. Return to the Nexus portal **Dashboard**
2. Confirm your deployment shows a green **Connected** status
3. The portal will display your stack outputs including the IAM role ARN and Cognito pool ID

## Step 6: Configure Your Identity Provider

After deployment, configure your OIDC provider to trust the deployed stack. See the [OIDC Setup Guide](./oidc-setup.md) for provider-specific instructions.

## Step 7: Distribute to Users

Once your IdP is configured:

1. Direct users to [nexus.allcode.com/download](https://nexus.allcode.com/download)
2. Users download and run the installer for their platform:
   - **macOS / Linux:** Run `install.sh`
   - **Windows:** Run `install.bat`
3. Users launch `claude` and authenticate via browser

## Troubleshooting

| Issue | Resolution |
|-------|-----------|
| Stack fails with IAM error | Ensure your AWS account has permission to create IAM roles and OIDC providers |
| Stack fails with Bedrock error | Verify Amazon Bedrock is enabled in the selected region |
| Portal shows "Disconnected" | Check that the stack completed successfully and the correct Account ID was provided |
| Users cannot authenticate | Verify OIDC provider configuration matches the values in the Nexus portal |

## Next Steps

- [Configure OIDC Provider](./oidc-setup.md)
- [Set Up Quota Policies](./quota-policies.md)
- [Review Security Posture](./security.md)