Reusable templates for creating tracked infrastructure, the defaults they hold, and the safety checks applied at instantiation.

Blueprints and provisioning

A Blueprint is a project-scoped template for creating a new resource. Unlike Import, instantiating one does change the provider account: it provisions real infrastructure, tracks the result, and may begin incurring provider charges.

Blueprints are not tied to one environment. They can suggest a target type, connection and environment, but the operator chooses the final destination when instantiating one.

What a blueprint keeps

A blueprint can keep:

• the resource type and usual target connection and environment;

• default environment variables;

• network defaults, such as subnets, security groups or an App Runner VPC connector;

• execution and workload-role defaults where the resource type uses them; and

• a configuration copied from an already tracked resource for supported types.

The editor offers guided sections for common deployment targets such as App Runner, Lambda, ECS Fargate, Cloudflare Pages and Azure Container Apps. The type list itself comes from the connected providers, so another provisionable type can still appear even when it has no dedicated guide form.

Saving a blueprint creates or changes only the template. Existing resources created from it are not updated when the template changes, and deleting the blueprint does not delete those resources.

Instantiating one

Open Resources, choose Provision resource, then select a blueprint or start without one. Review the final resource name, type, connection, environment and provider-specific fields before confirming.

Provisioning is queued as a background job because cloud creation can take minutes. The new resource appears as tracked after the provider creates it; Jobs carries progress and the provider's error if creation fails.

For supported deploy targets, the form can also create a one-stage pipeline wired to the new resource. This is opt-in: provisioning does not silently create deployment automation.

Safety and permissions

Every request requires an explicit confirmation. Provisioning also needs the plan capability and the relevant permission; a Production target additionally needs trigger-production.

Network and role pickers read live options from the selected connection. Choosing a VPC, subnet, security group or IAM role does not copy ownership of it into the blueprint—it records the provider identifier that the new resource will use. Test the connection first if those pickers are empty.