Skip to main content

Supported Services

Complete list of cloud services and resource types supported by Terraback across all providers.

AWS (Amazon Web Services)​

130 resource types across the services below

Compute & Containers​

ServiceCLI CommandResources
EC2ec2Instances, EBS volumes, EBS snapshots, AMIs, key pairs, launch templates, network interfaces
Auto ScalingautoscalingAuto Scaling groups, scaling policies, launch configurations
LambdalambdaFunctions, layer versions
ECSecsClusters, services, task definitions
ECRecrRepositories

Networking & Content Delivery​

ServiceCLI CommandResources
VPCvpcVPCs, subnets, security groups, internet gateways, NAT gateways, route tables, VPC endpoints
ELBv2elbv2Application/Network Load Balancers, target groups, target group attachments, listeners, listener rules, SSL policies, WAFv2 web ACL associations
ELB (Classic)elbClassic Load Balancers
CloudFrontcloudfrontDistributions, origin access controls, cache policies, origin request policies
Route 53route53Hosted zones, DNS records
Elastic IPseipsElastic IP addresses
API GatewayapigatewayREST APIs

Storage​

ServiceCLI CommandResources
S3s3Buckets, versioning, public access blocks
EFSefsFile systems, mount targets, access points

Databases & Caching​

ServiceCLI CommandResources
RDSrdsDB instances, DB subnet groups, DB parameter groups
DynamoDBdynamodbTables
ElastiCacheelasticacheRedis clusters, Memcached clusters, replication groups, subnet groups, parameter groups
OpenSearchopensearchDomains

Security & Identity​

ServiceCLI CommandResources
IAMiamRoles, policies
KMSkmsKeys, aliases
ACMacmCertificates
Secrets ManagersecretsmanagerSecrets, secret versions

Messaging & Integration​

ServiceCLI CommandResources
SNSsnsTopics, subscriptions
SQSsqsQueues, DLQ relationships
EventBridgeeventbridgeEvent buses, rules
Step FunctionsstepfunctionsState machines, activities
KinesiskinesisData streams, Firehose delivery streams

Monitoring & Management​

ServiceCLI CommandResources
CloudWatchcloudwatchLog groups, alarms, dashboards
CloudTrailcloudtrailTrails
SSMssmParameters, documents, maintenance windows

Streaming & Analytics​

ServiceCLI CommandResources
MSKmskKafka clusters

Backup & Recovery​

ServiceCLI CommandResources
AWS BackupbackupVaults

Threat Detection​

ServiceCLI CommandResources
GuardDutyguarddutyDetectors

Azure (Microsoft Azure)​

99 resource types across the services below

Compute & App Services​

ServiceCLI CommandResources
ComputecomputeVirtual machines, managed disks, VM scale sets, SSH keys, function apps, App Service plans, web apps
ContainercontainerKubernetes clusters, container registries

Networking​

ServiceCLI CommandResources
NetworknetworkVirtual networks, subnets, network interfaces, network security groups, public IPs, NAT gateways, route tables
Load BalancerlbLoad balancers, application gateways
CDNcdnCDN profiles, CDN endpoints
DNSdnsDNS zones, DNS records

Storage​

ServiceCLI CommandResources
StoragestorageStorage accounts, file shares

Databases​

ServiceCLI CommandResources
DatabasedatabaseSQL servers, SQL databases, SQL elastic pools

Caching​

ServiceCLI CommandResources
CachingcachingRedis Cache instances

Security & Identity​

ServiceCLI CommandResources
SecuritysecurityKey vaults, role assignments, role definitions, user-assigned identities

Messaging​

ServiceCLI CommandResources
MessagingmessagingService Bus namespaces, queues, topics, subscriptions, Event Hub namespaces

Monitoring​

ServiceCLI CommandResources
MonitoringmonitorLog Analytics workspaces, action groups, metric alerts, portal dashboards

Integration​

ServiceCLI CommandResources
IntegrationintegrationAPI Management instances, APIs

Resource Management​

ServiceCLI CommandResources
ResourcesresourcesResource groups

GCP (Google Cloud Platform)​

91 resource types across the services below

Compute & Serverless​

ServiceCLI CommandResources
Compute EnginecomputeInstances, disks, instance templates
Cloud FunctionsfunctionsCloud Functions
Cloud RuncloudrunCloud Run services

Networking​

ServiceCLI CommandResources
NetworknetworkVPC networks, subnets, firewall rules, routers, NAT gateways
Load BalancerloadbalancerBackend services, URL maps, regional URL maps, target HTTP/HTTPS/SSL/TCP proxies, regional target HTTP/HTTPS/TCP proxies, global forwarding rules
Certificate ManagercertificatemanagerCertificates, certificate maps

Storage​

ServiceCLI CommandResources
Cloud StoragestorageBuckets, Filestore instances

Databases​

ServiceCLI CommandResources
Cloud SQLsqlSQL instances, SQL databases
Firestore / Bigtable / SpannerdatabaseFirestore databases, Bigtable instances, Spanner instances

Containers​

ServiceCLI CommandResources
GKEgkeClusters, node pools
Container RegistrycontainerregistryContainer registries

Caching​

ServiceCLI CommandResources
MemorystorecachingRedis instances, Memcached instances

Security​

ServiceCLI CommandResources
SecuritysecurityKMS key rings, crypto keys, certificate authorities, Binary Authorization policies
Secret ManagersecretsSecrets

Messaging & Integration​

ServiceCLI CommandResources
Pub/SubpubsubTopics, subscriptions
Cloud TasksmessagingTask queues
IntegrationintegrationAPI gateways, Workflows, Eventarc triggers

Complete Resource Type Reference​

The counts above and the full enumerated list below are generated from the templates Terraback ships (scripts/gen_supported_resources.py), so they always match the installed version.

Terraback can generate 320 distinct Terraform resource types (AWS 130, Azure 99, GCP 91). The full list is enumerated below and is generated directly from the templates Terraback ships, so it always matches the installed version.

AWS (130 resource types)​

  • aws_acm_certificate
  • aws_ami
  • aws_api_gateway_deployment
  • aws_api_gateway_integration
  • aws_api_gateway_integration_response
  • aws_api_gateway_method
  • aws_api_gateway_method_response
  • aws_api_gateway_resource
  • aws_api_gateway_rest_api
  • aws_api_gateway_stage
  • aws_autoscaling_group
  • aws_autoscaling_policy
  • aws_backup_vault
  • aws_cloudfront_cache_policy
  • aws_cloudfront_distribution
  • aws_cloudfront_origin_access_control
  • aws_cloudfront_origin_request_policy
  • aws_cloudtrail
  • aws_cloudwatch_composite_alarm
  • aws_cloudwatch_dashboard
  • aws_cloudwatch_event_rule
  • aws_cloudwatch_event_target
  • aws_cloudwatch_log_group
  • aws_cloudwatch_metric_alarm
  • aws_db_instance
  • aws_db_parameter_group
  • aws_db_subnet_group
  • aws_dynamodb_table
  • aws_ebs_snapshot
  • aws_ebs_volume
  • aws_ec2_transit_gateway
  • aws_ec2_transit_gateway_connect
  • aws_ec2_transit_gateway_connect_peer
  • aws_ec2_transit_gateway_multicast_domain
  • aws_ec2_transit_gateway_peering_attachment
  • aws_ec2_transit_gateway_peering_attachment_accepter
  • aws_ec2_transit_gateway_route
  • aws_ec2_transit_gateway_route_table
  • aws_ec2_transit_gateway_route_table_association
  • aws_ec2_transit_gateway_route_table_propagation
  • aws_ec2_transit_gateway_vpc_attachment
  • aws_ecr_lifecycle_policy
  • aws_ecr_repository
  • aws_ecr_repository_policy
  • aws_ecs_cluster
  • aws_ecs_service
  • aws_ecs_task_definition
  • aws_efs_access_point
  • aws_efs_backup_policy
  • aws_efs_file_system
  • aws_efs_file_system_policy
  • aws_efs_mount_target
  • aws_eip
  • aws_eks_addon
  • aws_eks_cluster
  • aws_eks_identity_provider_config
  • aws_eks_node_group
  • aws_elasticache_cluster
  • aws_elasticache_parameter_group
  • aws_elasticache_replication_group
  • aws_elasticache_subnet_group
  • aws_elb
  • aws_flow_log
  • aws_guardduty_detector
  • aws_iam_policy
  • aws_iam_role
  • aws_instance
  • aws_internet_gateway
  • aws_key_pair
  • aws_kinesis_firehose_delivery_stream
  • aws_kinesis_stream
  • aws_kms_alias
  • aws_kms_key
  • aws_lambda_function
  • aws_lambda_layer_version
  • aws_lambda_permission
  • aws_launch_configuration
  • aws_launch_template
  • aws_lb
  • aws_lb_listener
  • aws_lb_listener_certificate
  • aws_lb_listener_rule
  • aws_lb_ssl_negotiation_policy
  • aws_lb_target_group
  • aws_lb_target_group_attachment
  • aws_nat_gateway
  • aws_network_interface
  • aws_network_interface_attachment
  • aws_route
  • aws_route53_record
  • aws_route53_zone
  • aws_route_table
  • aws_route_table_association
  • aws_s3_bucket
  • aws_s3_bucket_acl
  • aws_s3_bucket_cors_configuration
  • aws_s3_bucket_lifecycle_configuration
  • aws_s3_bucket_logging
  • aws_s3_bucket_notification
  • aws_s3_bucket_ownership_controls
  • aws_s3_bucket_policy
  • aws_s3_bucket_public_access_block
  • aws_s3_bucket_server_side_encryption_configuration
  • aws_s3_bucket_versioning
  • aws_s3_bucket_website_configuration
  • aws_secretsmanager_secret
  • aws_secretsmanager_secret_policy
  • aws_secretsmanager_secret_version
  • aws_security_group
  • aws_security_group_rule
  • aws_sfn_activity
  • aws_sfn_alias
  • aws_sfn_state_machine
  • aws_sns_topic
  • aws_sns_topic_subscription
  • aws_sqs_queue
  • aws_ssm_document
  • aws_ssm_maintenance_window
  • aws_ssm_maintenance_window_target
  • aws_ssm_maintenance_window_task
  • aws_ssm_parameter
  • aws_subnet
  • aws_vpc
  • aws_vpc_endpoint
  • aws_wafv2_web_acl
  • aws_wafv2_web_acl_association
  • aws_wafv2_web_acl_logging_configuration
  • aws_xray_encryption_config
  • aws_xray_group
  • aws_xray_sampling_rule

Azure (99 resource types)​

  • azurerm_api_connection
  • azurerm_api_management
  • azurerm_api_management_api
  • azurerm_app_configuration
  • azurerm_application_gateway
  • azurerm_application_insights
  • azurerm_application_security_group
  • azurerm_automation_account
  • azurerm_automation_runbook
  • azurerm_cdn_endpoint
  • azurerm_cdn_profile
  • azurerm_container_registry
  • azurerm_container_registry_webhook
  • azurerm_cosmosdb_account
  • azurerm_cosmosdb_sql_container
  • azurerm_cosmosdb_sql_database
  • azurerm_data_factory
  • azurerm_databricks_workspace
  • azurerm_dns_a_record
  • azurerm_dns_cname_record
  • azurerm_dns_ns_record
  • azurerm_dns_zone
  • azurerm_eventgrid_event_subscription
  • azurerm_eventgrid_topic
  • azurerm_eventhub
  • azurerm_eventhub_consumer_group
  • azurerm_eventhub_namespace
  • azurerm_image
  • azurerm_key_vault
  • azurerm_key_vault_certificate
  • azurerm_key_vault_key
  • azurerm_key_vault_secret
  • azurerm_kubernetes_cluster
  • azurerm_kubernetes_cluster_node_pool
  • azurerm_lb
  • azurerm_lb_backend_address_pool
  • azurerm_lb_nat_rule
  • azurerm_lb_probe
  • azurerm_lb_rule
  • azurerm_linux_virtual_machine_scale_set
  • azurerm_log_analytics_workspace
  • azurerm_logic_app_workflow
  • azurerm_managed_disk
  • azurerm_monitor_action_group
  • azurerm_monitor_activity_log_alert
  • azurerm_monitor_autoscale_setting
  • azurerm_monitor_diagnostic_setting
  • azurerm_monitor_metric_alert
  • azurerm_monitor_scheduled_query_rules_alert_v2
  • azurerm_mssql_database
  • azurerm_mssql_database_extended_auditing_policy
  • azurerm_mssql_elasticpool
  • azurerm_mssql_firewall_rule
  • azurerm_mssql_server
  • azurerm_mssql_server_extended_auditing_policy
  • azurerm_mssql_server_security_alert_policy
  • azurerm_mssql_virtual_network_rule
  • azurerm_nat_gateway
  • azurerm_netapp_account
  • azurerm_netapp_pool
  • azurerm_netapp_volume
  • azurerm_network_interface
  • azurerm_network_security_group
  • azurerm_portal_dashboard
  • azurerm_private_dns_a_record
  • azurerm_private_dns_zone
  • azurerm_private_endpoint
  • azurerm_proximity_placement_group
  • azurerm_public_ip
  • azurerm_recovery_services_vault
  • azurerm_redis_cache
  • azurerm_redis_enterprise_cluster
  • azurerm_redis_enterprise_database
  • azurerm_redis_firewall_rule
  • azurerm_redis_linked_server
  • azurerm_resource_group
  • azurerm_role_assignment
  • azurerm_role_definition
  • azurerm_route
  • azurerm_route_table
  • azurerm_search_service
  • azurerm_service_plan
  • azurerm_servicebus_namespace
  • azurerm_servicebus_queue
  • azurerm_servicebus_subscription
  • azurerm_servicebus_topic
  • azurerm_ssh_public_key
  • azurerm_storage_account
  • azurerm_storage_share
  • azurerm_subnet
  • azurerm_subnet_nat_gateway_association
  • azurerm_subnet_network_security_group_association
  • azurerm_subnet_route_table_association
  • azurerm_user_assigned_identity
  • azurerm_virtual_machine_data_disk_attachment
  • azurerm_virtual_network
  • azurerm_virtual_network_peering
  • azurerm_web_application_firewall_policy
  • azurerm_windows_virtual_machine_scale_set

GCP (91 resource types)​

  • google_api_gateway_api
  • google_api_gateway_api_config
  • google_api_gateway_gateway
  • google_artifact_registry_repository
  • google_bigquery_dataset
  • google_bigquery_table
  • google_bigtable_app_profile
  • google_bigtable_instance
  • google_bigtable_table
  • google_bigtable_table_iam_binding
  • google_binary_authorization_policy
  • google_certificate_manager_certificate
  • google_certificate_manager_certificate_map
  • google_cloud_run_service
  • google_cloud_run_service_iam_policy
  • google_cloud_run_v2_job
  • google_cloud_scheduler_job
  • google_cloud_tasks_queue
  • google_cloudbuild_trigger
  • google_cloudfunctions2_function
  • google_composer_environment
  • google_compute_address
  • google_compute_backend_bucket
  • google_compute_backend_service
  • google_compute_disk
  • google_compute_firewall
  • google_compute_forwarding_rule
  • google_compute_global_forwarding_rule
  • google_compute_health_check
  • google_compute_image
  • google_compute_instance
  • google_compute_instance_group
  • google_compute_instance_template
  • google_compute_network
  • google_compute_network_peering
  • google_compute_region_backend_service
  • google_compute_region_target_http_proxy
  • google_compute_region_target_https_proxy
  • google_compute_region_target_tcp_proxy
  • google_compute_region_url_map
  • google_compute_router
  • google_compute_router_nat
  • google_compute_security_policy
  • google_compute_snapshot
  • google_compute_subnetwork
  • google_compute_target_http_proxy
  • google_compute_target_https_proxy
  • google_compute_target_ssl_proxy
  • google_compute_target_tcp_proxy
  • google_compute_url_map
  • google_compute_vpn_tunnel
  • google_container_cluster
  • google_container_node_pool
  • google_container_registry
  • google_dataproc_cluster
  • google_deployment_manager_deployment
  • google_dns_managed_zone
  • google_dns_record_set
  • google_eventarc_trigger
  • google_filestore_instance
  • google_firestore_database
  • google_firestore_index
  • google_kms_crypto_key
  • google_kms_crypto_key_iam_member
  • google_kms_key_ring
  • google_kms_key_ring_iam_member
  • google_logging_project_sink
  • google_memcache_instance
  • google_monitoring_alert_policy
  • google_monitoring_dashboard
  • google_monitoring_notification_channel
  • google_privateca_certificate_authority
  • google_project_iam_binding
  • google_project_iam_custom_role
  • google_project_iam_member
  • google_pubsub_subscription
  • google_pubsub_topic
  • google_redis_instance
  • google_secret_manager_secret
  • google_secret_manager_secret_version
  • google_service_account
  • google_service_account_key
  • google_spanner_database
  • google_spanner_database_iam_binding
  • google_spanner_instance
  • google_spanner_instance_iam_binding
  • google_sql_database
  • google_sql_database_instance
  • google_storage_bucket
  • google_storage_bucket_iam_binding
  • google_workflows_workflow

Licensing​

Some services require a Professional license. Core infrastructure services (VPC, EC2, S3, VMs, networks, storage) are available in the Community (Free) tier. Advanced services (RDS, Lambda, ECS, databases, serverless, etc.) require Professional.

See Licensing for full details on which services are included in each tier.