Skip to main content

Cloud

Cloud connections are referenced by tag (for example prod_aws), not internal IDs.

ductape cloud connections list
ductape cloud connections create -f connection.json
ductape cloud connections get <cloud-tag>
ductape cloud connections update <cloud-tag> -f update.json
ductape cloud connections complete <cloud-tag> -f complete.json
ductape cloud connections validate <cloud-tag>
ductape cloud connections delete <cloud-tag>
ductape cloud resources list -f query.json

Connections are referenced by tag (for example prod_aws), not internal IDs.

Connection commands​

Create​

connection.json:

{
  "provider": "aws",
  "name": "Production AWS",
  "scopes": ["storage", "broker", "database", "graph", "vector"]
}
ductape cloud connections create -f connection.json

Complete setup (credentials)​

AWS — complete.json:

{
  "role_arn": "arn:aws:iam::123456789012:role/DuctapeAccess"
}

Azure — complete.json:

{
  "tenant_id": "00000000-0000-0000-0000-000000000000",
  "subscription_id": "00000000-0000-0000-0000-000000000000",
  "client_id": "00000000-0000-0000-0000-000000000000",
  "client_secret": "your-client-secret",
  "default_location": "eastus"
}

GCP — complete.json:

{
  "project_id": "my-gcp-project",
  "service_account_json": { "type": "service_account", "project_id": "..." }
}

MongoDB Atlas — complete.json:

{
  "project_id": "5c843ba379358e5b3dc2dec6",
  "atlas_public_key": "awqxqtif",
  "atlas_private_key": "your-private-key"
}

Neo4j Aura — complete.json:

{
  "aura_client_id": "your-client-id",
  "aura_client_secret": "your-client-secret"
}
ductape cloud connections complete prod_aws -f complete.json
ductape cloud connections complete prod_gcp -f complete-gcp.json
ductape cloud connections complete prod_atlas -f complete-atlas.json
ductape cloud connections validate prod_aws

See Cloud connections and provider guides for full setup checklists.

Omit client_secret (or other secret fields) on a later complete call to keep the stored value; include them only when rotating credentials.

Update display name or description​

update.json:

{
  "display_name": "Production AWS (US-East)",
  "description": "Primary US-East production account"
}
ductape cloud connections update prod_aws -f update.json

The connection tag cannot be changed after creation.

Delete​

ductape cloud connections delete prod_aws

Removes the connection from the workspace (soft delete). Linked product components may fail until credentials are configured again.

AWS networking (RDS / Neptune)​

Configure VPC access from the Workbench (Security groups tab) or any SDK. Two modes:

  • Managed allowlist — updateManagedNetworking saves CIDRs; Ductape creates/syncs a security group (requires extra EC2 IAM on your DuctapeAccess role).
  • Customer-managed groups — updateSecurityGroups registers pre-configured groups; you create inbound rules in EC2.

Resolve API/proxy hostname for hosted allowlisting:

const { addresses } = await ductape.cloud.connections.resolveNetworkingHost('api.ductape.app');

Managed allowlist example:

await ductape.cloud.connections.updateManagedNetworking('prod_aws', {
  mode: 'managed',
  include_ductape_proxy: true,
  ductape_proxy_host: 'api.ductape.app',
  allowed_sources: [{ cidr: '203.0.113.10/32', label: 'App NAT' }],
  region: 'us-east-1',
});

Customer-managed registry example:

await ductape.cloud.connections.updateSecurityGroups('prod_aws', {
  security_groups: [{
    tag: 'prod-rds',
    groupId: 'sg-abc123',
    resourceTypes: ['rds', 'neptune'],
  }],
});

VPC connector (private RDS / Neptune)​

await ductape.cloud.connections.updateVpcConnector('prod_aws', {
  vpc_id: 'vpc-abc123',
  subnet_ids: ['subnet-aaa', 'subnet-bbb'],
  region: 'us-east-1',
});

await ductape.cloud.connections.getVpcConnectorStatus('prod_aws');

Deploy the outbound agent from connectors/aws-vpc-agent using the enrollment token from Workbench.

When networking.mode is vpc_connector, hosted proxy and Workbench database tests route PostgreSQL (and Neptune Gremlin) through the connector relay WebSocket at /integrations/v1/cloud/vpc-connector/relay/ws — no Ductape IP allowlisting required.

See AWS networking for IAM policy, ports, and RDS vs Neptune guidance.

Supported service values​

ProviderStorageBrokerDatabaseGraphVector
AWSs3sqsrdsneptuneopensearch
GCPgcspubsubcloudsqlspanner-graphvertex-vector-search
Azureblobservicebuspostgresqlcosmos-gremlinazure-search

List resources​

AWS S3:

{
  "cloud": "prod_aws",
  "service": "s3",
  "region": "us-east-1"
}

GCP Pub/Sub:

{
  "cloud": "gcp_prod",
  "service": "pubsub",
  "region": "us-central1"
}

GCP Cloud SQL:

{
  "cloud": "gcp_prod",
  "service": "cloudsql",
  "region": "us-central1"
}

Azure Service Bus:

{
  "cloud": "prod_azure",
  "service": "servicebus",
  "region": "eastus"
}

Azure PostgreSQL:

{
  "cloud": "prod_azure",
  "service": "postgresql",
  "region": "eastus"
}

Azure Cosmos DB (Gremlin):

{
  "cloud": "prod_azure",
  "service": "cosmos-gremlin",
  "region": "eastus"
}

GCP Vertex AI Vector Search:

{
  "cloud": "gcp_prod",
  "service": "vertex-vector-search",
  "region": "us-central1"
}

Requires a linked project and login.

Provision resources​

Provisioning creates a new cloud resource and links it to a product component. Always check available tiers first.

1. List tiers​

# All tiers for a provider / resource type
ductape cloud tiers list --provider aws --type database --db-type postgresql
ductape cloud tiers list --provider gcp --type database --db-type mysql
ductape cloud tiers list --provider azure --type database
ductape cloud tiers list --provider mongodb_atlas
ductape cloud tiers list --provider neo4j_aura --type graph

Pick the name value from a tier entry — that is your --tier argument.

2. Provision​

provision.json must contain service, type, product, component, and env. Pass --tier on the command line or include it in the JSON.

Database — AWS RDS (PostgreSQL):

cat provision.json
# { "cloud": "prod_aws", "service": "rds", "type": "databases",
#   "product": "my-product", "component": "app-db", "env": "prd",
#   "region": "us-east-1", "dbName": "myapp" }

ductape cloud resources provision -f provision.json --tier db.t3.micro

Database — GCP Cloud SQL:

# { "cloud": "gcp_prod", "service": "cloudsql", "type": "databases",
#   "product": "my-product", "component": "app-db", "env": "prd",
#   "region": "us-central1" }
ductape cloud resources provision -f provision.json --tier db-n1-standard-2

Database — Azure Flexible Server:

# { "cloud": "prod_azure", "service": "postgresql", "type": "databases",
#   "product": "my-product", "component": "app-db", "env": "prd",
#   "region": "eastus" }
ductape cloud resources provision -f provision.json --tier Standard_B1ms

Storage (no tier needed — class is set via the JSON or defaults):

# { "cloud": "prod_aws", "service": "s3", "type": "storage",
#   "product": "my-product", "component": "uploads", "env": "prd",
#   "bucketName": "my-app-uploads", "region": "us-east-1" }
ductape cloud resources provision -f provision.json

Message broker — AWS SQS:

# { "cloud": "prod_aws", "service": "sqs", "type": "messageBrokers",
#   "product": "my-product", "component": "order-events", "env": "prd",
#   "queueName": "order-events", "region": "us-east-1" }
ductape cloud resources provision -f provision.json

Graph — AWS Neptune:

# { "cloud": "prod_aws", "service": "neptune", "type": "graphs",
#   "product": "my-product", "component": "social-graph", "env": "prd",
#   "region": "us-east-1" }
ductape cloud resources provision -f provision.json --tier db.r5.large

Vector — AWS OpenSearch:

# { "cloud": "prod_aws", "service": "opensearch", "type": "vectors",
#   "product": "my-product", "component": "product-vectors", "env": "prd",
#   "region": "us-east-1" }
ductape cloud resources provision -f provision.json --tier t3.small.search

--tier is merged into the JSON body at send time. You can also include "tier": "db.t3.micro" directly in provision.json.

To skip waiting for the resource to be ready (databases can take several minutes):

ductape cloud resources provision -f provision.json --tier db.t3.micro
# add "waitForReady": false in the JSON to return immediately

See Link components and Cloud overview for provisioning and linking from the SDK (TypeScript, Go, Java, .NET).