Import, provisioning, teardown and detail-panel capabilities for every resource type exposed by every connector.
Resource type reference
Use this page when you know the connector and need to know exactly what xAuto can do with one resource type. For credential fields, connection scope and connection-test behavior, see the Connector reference.
How to read the tables
Import lists existing provider resources and creates a tracked xAuto record for the selection. It does not alter the provider resource.
Provision creates a real provider resource, then tracks it. The form and any blueprint must supply the dependencies named by that resource type.
Destroy removes the real provider resource. The action appears only when the type has a delete implementation and the resource was provisioned by xAuto. An imported resource can be untracked, but cannot be destroyed from the generic resource action.
Every tracked resource has Overview, Catalog & permissions, and History. Catalog holds owner, repository, documentation, tags, alert mutes and resource-access rules. History is sampled status unless the resource supplies a more useful provider operation or deployment history.
“Provider facts” below means the overview is intentionally read-oriented. The shared catalog, permissions, history, cost and architecture features still apply where the provider supplies the required data.
AWS
AWS inventory is read in the connection's region, except for global services such as S3 and CloudFront. A successful STS connection test does not grant the service permissions required by every row.
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
App Runner service (apprunner-service) | Yes | Yes | Yes | Service configuration and deployment state; CPU, memory and application metrics; edit environment variables; instance configuration; convert to ECS; provider operation history. Configuration can be copied into a provision form. |
ECS service (ecs-service) | Yes | Yes | Yes | Tasks and deployment state; logs and metrics; environment variables, secrets, compare/sync and Parameter Store; network configuration; expose through an ALB or API Gateway VPC Link; IAM roles; copy a cluster; deployment history. Security groups can be replaced in place and configuration can seed provisioning. |
EC2 instance (ec2-instance) | Yes | Yes | No | Instance, image, network and lifecycle facts plus CPU, memory and application metrics. The generic xAuto destroy action is not registered for EC2. |
Bastion host (bastion-host) | Yes | Yes | Yes | EC2-backed bastion facts and connection information/key download. A tracked bastion can be selected as the route for database connections and backups. |
RDS instance (rds-instance) | Yes | Yes | Yes | Database configuration and lifecycle; provider snapshots and system-dump backups; metrics; environment sync; direct connection details, SSH tunnel and query console. Configuration can seed provisioning. |
ElastiCache cluster (elasticache-cluster) | Yes | Yes | No | Cache topology and lifecycle; backups and metrics; direct Redis connection, SSH tunnel and command console. Read-only Redis sessions reject write commands before sending them. |
Load balancer (load-balancer) | Yes | Yes | No | Load-balancer identity, scheme, state, listeners, networking and provider facts. It participates in architecture discovery but has no dedicated teardown action. |
NAT gateway (nat-gateway) | Yes | Yes | No | State, VPC, subnet, addresses and provider facts. It participates in network architecture discovery; deletion is not exposed. |
Elastic IP (elastic-ip) | Yes | Yes | No | Allocation, association, public/private address and provider facts. Release is not exposed through generic teardown. |
S3 bucket (s3-bucket) | Yes | Yes | Yes | Bucket configuration and provider facts plus cross-region or cross-account copy. Teardown is available only for xAuto-provisioned buckets and remains subject to AWS bucket-deletion constraints. |
ECR repository (ecr-repository) | Yes | Yes | Yes | Read-only repository name and URI in the detail panel. Image inventory, image deletion and repository-setting edits are not exposed there. |
API Gateway REST API (api-gateway-rest-api) | Yes | Yes | No | API configuration, resources, methods, stages and deployments, plus copy to another region. Generic teardown is not registered. |
CodeBuild project (codebuild-project) | Yes | Yes | Yes | Source, build environment, service role, artifacts and recent builds; read-only environment variables; manage webhook trigger branches. |
VPC (vpc) | Yes | Yes | No | CIDR, tenancy, DNS and network inventory used by architecture discovery. Subnets and related dependencies are displayed as provider facts; VPC teardown is not exposed. |
Lambda function (lambda-function) | Yes | Yes | Yes | Function state and configuration; invocation usage and logs; edit, encrypt, compare and sync environment variables; image, triggers and network; invoke with a test payload; clone; provider operation history. Security groups can be replaced in place and configuration can seed provisioning. |
SQS queue (sqs-queue) | Yes | Yes | No | Queue URL/ARN, type, retention, visibility, encryption and message counters. Generic queue teardown is not registered. |
OpenSearch domain (opensearch-domain) | Yes | Yes | Yes | Domain topology and health; list indices; run queries; discover Dashboards and reports; inspect or configure platform access to VPC domains. |
Security group (security-group) | Yes | Yes | Yes | Inbound/outbound rule inventory and associated tracked resources. Bulk security-group replacement applies to ECS and Lambda targets, not to every AWS compute/database type. |
EventBridge rule (eventbridge-rule) | Yes | Yes | No | Schedule/event pattern, state, bus and target inventory with purpose-built rule details. Generic teardown is not registered. |
CloudFront distribution (cloudfront-distribution) | Yes | Yes | Yes | Distribution, origins, aliases and deployment state; configure a custom domain and manage distribution tenants. |
ACM certificate (acm-certificate) | Yes | Yes | Yes | Certificate status, names, expiry and DNS-validation records. Provisioning requests a certificate; DNS validation may still require an external delegation change. |
SES identity (ses-identity) | Yes | Yes | Yes | Email/domain identity, verification and DKIM state with the provider records needed to complete verification. |
SES account (ses-account) | Yes | No | No | Account-level analysis only: message log, reputation, suppression list, configuration sets and deliverability settings. There is one summary resource per connection/region. |
Provisioning an AWS resource does not implicitly create every dependency. For example, ECS expects an existing cluster, subnets and execution role; Lambda expects an execution role and image; and App Runner may require existing IAM roles, a VPC connector or VPC endpoint. The form names these dependencies before the job is queued.
MongoDB Atlas
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Atlas cluster (atlas-cluster) | Yes | Yes | No | Cluster lifecycle and scaling; database discovery; Atlas cloud snapshots and restore; system-dump backups and sync; cost and architecture; permanent or temporary SCRAM users, AWS-IAM database users and IP access-list grants. Generic cluster teardown is not registered. |
Atlas access can be narrowed to database and collection. Cloud snapshots are provider-native; system dumps use xAuto's backup destination and restore workflow. Those are separate backup records with different restore paths.
Azure
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Resource group (azure-resource-group) | Yes | Yes | No | Subscription, location, tags and provider facts. It is a grouping and architecture boundary; recursive resource-group deletion is not exposed. |
App Service (azure-app-service) | Yes | Yes | No | App identity, state, runtime, hostnames and plan; application metrics; edit and compare app settings. Generic teardown is not registered. |
App Service slot (azure-app-service-slot) | Yes | Yes | No | Slot identity, state, hostnames and parent app; edit and compare app settings. Slot teardown and swap are not exposed through the generic resource action. |
Container App (azure-container-app) | Yes | Yes | Yes | Container, revision, ingress and scaling facts; edit environment variables; application metrics. Configuration can be copied into a provision form. |
SQL database (azure-sql-database) | Yes | Yes | No | Status, service tier, maximum size and collation; pause or resume a serverless database. Database access participates in approval-backed, time-limited access requests. Generic database teardown is not registered. |
Storage Account (azure-storage-account) | Yes | Yes | Yes | Account settings and blob-container inventory; list and manage queues; compare and synchronize queues between accounts. Configuration can be copied into a provision form. |
All six Azure types can be created from Resources or a blueprint. Provider-native operations still enforce subscription policy, naming rules, location availability and the service principal's RBAC.
Azure DevOps
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Pipeline definition (azuredevops-pipeline) | Yes | Yes | No | Definition details; latest build with nested stage, phase and job timeline; recent build history; manually queue a run or cancel an active run. It can also be selected as an xAuto pipeline stage. |
Provisioning creates the pipeline definition only. The repository, YAML file and any GitHub service connection must already exist and be visible to the stored Personal Access Token.
SendGrid
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Dynamic template (sendgrid-template) | Yes | Yes | No | Template identity and provider facts with shared catalog, permissions and status history. Provisioning creates a named dynamic template; template-version authoring and deletion are not exposed in its resource panel. |
The connector overview additionally shows account type, sender reputation and the complete dynamic template inventory. Those account facts are not separate tracked resource types.
Firebase Cloud Messaging
FCM exposes no tracked resource type. Its connector pane validates a single test notification against a device token in dry-run mode, or sends that notification when dry run is deliberately disabled. Consequently there is no Import, Provision, Resource detail or Destroy workflow for FCM.
Google Cloud Platform
GCP inventory is project-wide and split by API. One disabled or under-permissioned API produces a warning for its resource type without hiding inventory returned by the other APIs.
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Cloud Run service (gcp-cloud-run-service) | Yes | Yes | No | Service condition and URL; revisions and traffic; environment variables; CPU, memory, scaling and runtime configuration; access policy; logs. Provisioning accepts an image, region, CPU, memory and unauthenticated-access choice. |
Cloud Run job (gcp-cloud-run-job) | Yes | No | No | Image, task count, parallelism, retries, timeout, service account and CPU/memory; execution history; run now and cancel an active execution. Creation and generic teardown are not exposed. |
Cloud Function (gcp-cloud-function) | Yes | No | No | Function runtime, trigger and state; edit environment and supported runtime settings. |
Compute Engine instance (gcp-compute-instance) | Yes | No | No | VM configuration, network and lifecycle controls, plus serial-console output for boot diagnosis. |
Cloud Storage bucket (gcp-storage-bucket) | Yes | No | No | Browse and manage objects; inspect and update supported bucket settings. |
Cloud SQL instance (gcp-cloud-sql-instance) | Yes | No | No | Full management surface: databases, users, backups and data movement, configuration, connectivity, replicas and provider operations. Instance and replica creation is kept inside this panel rather than the generic Provision resource picker. |
Firestore database (gcp-firestore-database) | Yes | No | No | Database facts plus protection, point-in-time/backup configuration and export/import operations supported by the panel. |
Memorystore for Redis (gcp-memorystore-redis) | Yes | No | No | Instance facts; capacity and data controls, including supported scaling and failover operations. |
VPC network (gcp-vpc-network) | Yes | No | No | Manage subnets, firewall rules, routes and network peerings. Network creation/deletion is not exposed in the generic lifecycle action. |
Load balancer (gcp-load-balancer) | Yes | No | No | Resolve the forwarding rule through its target, URL map and backend services; show backend health and partial-read warnings. The panel can delete the forwarding rule after name confirmation, leaving proxies, maps and backends intact. |
Pub/Sub topic (gcp-pubsub-topic) | Yes | No | No | Manage subscriptions and publish or inspect messages through the topic panel. |
Only Cloud Run services appear in the generic provisioning picker. Several imported GCP types have substantial in-panel management; “Provision: No” means the top-level provisioning workflow cannot create that tracked type, not that its detail panel is read-only. No GCP type currently registers the generic xAuto Destroy action.
Cloudflare
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Zone (cloudflare-zone) | Yes | Yes | No | Zone status, authoritative/paused state and DNS records. List, create, edit and remove supported records. Provisioning registers the zone but does not change registrar nameservers. |
Pages project (cloudflare-pages-project) | Yes | Yes | Yes | Project/build/deployment details and logs; Production and Preview variables and write-only secrets; project settings; custom domains. |
Cloudflare authorization combines token permissions with included account/zone resources. A DNS operation can therefore fail even when the token itself verifies successfully.
Self-hosted databases
| Resource type | Import | Provision | Destroy | Resource-specific reference |
|---|---|---|---|---|
Database server (self-hosted-database-server) | Registration only | No | No | PostgreSQL, MongoDB or MySQL reached directly, through an SSH tunnel, or by remote execution; discover databases and tables/collections; create, schedule and restore system-dump backups; synchronize supported data. |
This row is created by successful registration from Backups, not by the generic connector Import screen. xAuto manages backup and restore activity inside the server; it does not create, stop or delete the host or database server.
Lifecycle safety summary
Import and untrack are platform-record operations. Provision and Destroy are provider mutations and may incur cost, encounter dependency constraints, or require approval under the environment's change approval policy. In-panel actions can also mutate provider configuration; their buttons are subject to the same platform role and resource-access checks even when the table's generic Destroy column says No.