AWS Components

Reference for every AWS offer in the Fractal Cloud catalogue. Each offer lists its parameters, required flags, and a fully-parameterized JSON example.

APIManagement

APIManagement.CaaS.Ambassador

Ambassador is an open-source API gateway built on Envoy that provides advanced traffic management, authentication, and routing capabilities for containerized workloads on Kubernetes. The gateway is Emissary-ingress, the open-source (Apache 2.0) edition of Ambassador.

Parameter	Description	Example / possible values	Required
host	The hostname for the Ambassador service	ambassador.example.com	No
hostOwnerEmail	Email address of the host owner for certificate renewal notifications	admin@example.com	Yes
acmeProviderAuthority	ACME certificate authority endpoint for TLS certificate provisioning	https://acme-v02.api.letsencrypt.org/directory	Yes
tlsSecretName	Kubernetes secret name containing TLS certificate data	ambassador-tls-secret	Yes
namespace	Kubernetes namespace where Ambassador will be deployed	ambassador	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "APIManagement.CaaS.Ambassador",
  "parameters": {
    "host": "ambassador.example.com",
    "hostOwnerEmail": "admin@example.com",
    "acmeProviderAuthority": "https://acme-v02.api.letsencrypt.org/directory",
    "tlsSecretName": "ambassador-tls-secret",
    "namespace": "ambassador"
  }
}

APIManagement.CaaS.Traefik

Traefik is a modern reverse proxy and load balancer that automatically discovers services and provides dynamic routing, SSL/TLS termination, and advanced security features for cloud-native applications.

Parameter	Description	Example / possible values	Required
entryPoints	List of network entry points (ports/protocols) where Traefik listens for incoming traffic	["http:8080", "https:8443"]	Yes
hostname	Hostname for Traefik dashboard and routing configuration	traefik.example.com	No
loadbalancerIp	Static IP address to assign to the Traefik load balancer service	10.0.1.100	No
oidcIssuerUrl	OpenID Connect issuer URL for authentication	https://auth.example.com	Conditional — part of the all-or-nothing OIDC config group
oidcClientId	OIDC client identifier	traefik-client-id	Conditional — part of the all-or-nothing OIDC config group
oidcClientSecretId	Secret identifier for OIDC client credentials	oidc-secret-id	Conditional — part of the all-or-nothing OIDC config group
forwardAuthSecretId	Secret identifier for forward authentication configuration	forward-auth-secret-id	Conditional — part of the all-or-nothing OIDC config group
securityHeadersSettings	Map of HTTP security headers to apply to all responses	{}	No
tlsCertificates	List of TLS certificate configurations	[]	No
tlsSettings	TLS/SSL settings such as minimum version and cipher suites	{}	No
tracing	Distributed tracing configuration for monitoring request flows	{}	No
namespace	Kubernetes namespace where Traefik will be deployed	traefik	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "APIManagement.CaaS.Traefik",
  "parameters": {
    "entryPoints": ["http:8080", "https:8443"],
    "hostname": "traefik.example.com",
    "loadbalancerIp": "10.0.1.100",
    "oidcIssuerUrl": "https://auth.example.com",
    "oidcClientId": "traefik-client-id",
    "oidcClientSecretId": "oidc-secret-id",
    "forwardAuthSecretId": "forward-auth-secret-id",
    "securityHeadersSettings": { "X-Frame-Options": "DENY" },
    "tlsCertificates": [],
    "tlsSettings": { "minVersion": "VersionTLS12" },
    "tracing": {},
    "namespace": "traefik"
  }
}

APIManagement.PaaS.AwsCloudFront

Amazon CloudFront distribution fronting an origin with a global edge network. SDK-canonical name for the same offer as APIManagement.PaaS.CloudFront; both route to the same agent handler.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
originDomain	Domain name of the origin the distribution pulls from. Blank → resolved from the component this distribution depends on.	origin.example.com	No
comment	Free-text comment stored on the distribution	Managed by Fractal Cloud	No

Example (fully parameterized):

{
  "type": "APIManagement.PaaS.AwsCloudFront",
  "parameters": {
    "originDomain": "origin.example.com",
    "comment": "Managed by Fractal Cloud"
  }
}

APIManagement.PaaS.CloudFront

Amazon CloudFront is a content delivery network (CDN) service that caches and serves content from edge locations around the world, providing low-latency access and DDoS protection.

Parameter	Description	Example / possible values	Required
originDomain	The domain name or IP address of the origin server where content is stored	example.com or api.example.com	No
comment	Human-readable description of the CloudFront distribution	Managed by Fractal Cloud	No

Example (fully parameterized):

{
  "type": "APIManagement.PaaS.CloudFront",
  "parameters": {
    "originDomain": "api.example.com",
    "comment": "Managed by Fractal Cloud"
  }
}

APIManagement.SaaS.Unmanaged

A placeholder for external or pre-existing API management solutions not directly provisioned by Fractal Cloud. Stores connection details and credentials in a secret.

Parameter	Description	Example / possible values	Required
secretName	Name or identifier of the secret storing credentials	api-mgmt-secret	No
secretValue	The secret value (credentials, connection string, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "APIManagement.SaaS.Unmanaged",
  "parameters": {
    "secretName": "api-mgmt-secret",
    "secretValue": "secret-content"
  }
}

BigData

BigData.CaaS.MinioTenant

MinIO is a high-performance, S3-compatible object storage system deployable on Kubernetes. Provides distributed object storage with strong consistency and security.

Parameter	Description	Example / possible values	Required
minioVersion	MinIO release version	RELEASE.2025-03-12T18-04-18Z	No
servers	Number of MinIO servers in the distributed cluster	4	No
volumesPerServer	Number of storage volumes per server	4	No
volumeSize	Storage volume size per server (Kubernetes resource quantity)	100Gi	No
storageClass	Kubernetes storage class for persistent volumes	empty string (cluster default)	No
cpuRequest	Requested CPU per MinIO pod	500m	No
cpuLimit	Maximum CPU per MinIO pod	2	No
memoryRequest	Requested memory per MinIO pod	1Gi	No
memoryLimit	Maximum memory per MinIO pod	4Gi	No
requestAutoCert	Automatically generate self-signed TLS certificates	true	No
namespace	Kubernetes namespace for MinIO deployment	minio	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "BigData.CaaS.MinioTenant",
  "parameters": {
    "minioVersion": "RELEASE.2025-03-12T18-04-18Z",
    "servers": 4,
    "volumesPerServer": 4,
    "volumeSize": "100Gi",
    "storageClass": "gp3",
    "cpuRequest": "500m",
    "cpuLimit": "2",
    "memoryRequest": "1Gi",
    "memoryLimit": "4Gi",
    "requestAutoCert": true,
    "namespace": "minio"
  }
}

BigData.CaaS.SparkCluster

Apache Spark cluster for distributed data processing and analytics on Kubernetes. Provides driver and executor pods for parallel computation.

Parameter	Description	Example / possible values	Required
sparkVersion	Apache Spark version	3.5.3	No
image	Container image URI for Spark pods	apache/spark:3.5.3	No
driverCores	Number of CPU cores for the Spark driver pod	1	No
driverMemory	Memory allocated to the Spark driver pod	1g	No
executorCores	Number of CPU cores per executor pod	2	No
executorMemory	Memory allocated to each executor pod	2g	No
executorInstances	Number of executor pods to launch	2	No
sparkOperatorName	Name of the Spark Operator deployment managing this cluster	spark-operator	Yes
namespace	Kubernetes namespace for Spark cluster	spark	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkCluster",
  "parameters": {
    "sparkVersion": "3.5.3",
    "image": "apache/spark:3.5.3",
    "driverCores": "1",
    "driverMemory": "1g",
    "executorCores": "2",
    "executorMemory": "2g",
    "executorInstances": 2,
    "sparkOperatorName": "spark-operator",
    "namespace": "spark"
  }
}

BigData.CaaS.SparkJob

A Spark job submission to a Spark cluster or standalone Spark operator, supporting batch processing, scheduled execution, and multiple application types.

Parameter	Description	Example / possible values	Required
type	Spark application type	Java, Python, Scala	No
mode	Spark deployment mode	cluster or client	No
image	Container image URI for the Spark job	apache/spark:3.5.3	No
mainClass	Fully qualified class name for Java/Scala applications	com.example.MyApp	No
mainApplicationFile	Path or URI to the application JAR, Python script, or other artifact	s3://bucket/app.jar	No
arguments	List of command-line arguments passed to the application	["arg1", "arg2"]	No
sparkVersion	Apache Spark version	3.5.3	No
sparkConf	Spark configuration properties as key-value pairs	{}	No
driverCores	Number of CPU cores for the driver	1	No
driverMemory	Memory for the driver	1g	No
executorCores	Number of CPU cores per executor	2	No
executorMemory	Memory per executor	2g	No
executorInstances	Number of executors	2	No
restartPolicy	Pod restart policy on failure	Never, OnFailure	No
maxRetries	Maximum number of retries on failure	3	No
schedule	Cron schedule for periodic execution (blank = one-time)	0 0 * * *	No
concurrencyPolicy	How to handle concurrent executions	Allow, Forbid, Replace	No
sparkOperatorName	Name of the Spark Operator deployment	spark-operator	Yes
namespace	Kubernetes namespace	spark	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkJob",
  "parameters": {
    "type": "Java",
    "mode": "cluster",
    "image": "apache/spark:3.5.3",
    "mainClass": "com.example.MyApp",
    "mainApplicationFile": "s3://bucket/app.jar",
    "arguments": ["--input", "s3://bucket/data/input", "--output", "s3://bucket/data/output"],
    "sparkVersion": "3.5.3",
    "sparkConf": { "spark.executor.memoryOverhead": "512m" },
    "driverCores": "1",
    "driverMemory": "1g",
    "executorCores": "2",
    "executorMemory": "2g",
    "executorInstances": 2,
    "restartPolicy": "Never",
    "maxRetries": 3,
    "schedule": "0 0 * * *",
    "concurrencyPolicy": "Forbid",
    "sparkOperatorName": "spark-operator",
    "namespace": "spark"
  }
}

BigData.CaaS.SparkMlExperiment

MLflow experiment tracking service for machine learning workflows on Kubernetes. Provides artifact storage and metrics logging for ML experiments.

Parameter	Description	Example / possible values	Required
mlflowVersion	MLflow server version	2.21.3	No
backendStoreUri	Backend store URI for MLflow metadata (SQLite, PostgreSQL, etc.)	sqlite:///mlflow/mlflow.db	No
artifactRoot	Root directory for storing artifacts	/mlflow/artifacts	No
replicas	Number of MLflow server replicas	2	No
cpuRequest	Requested CPU per MLflow pod	250m	No
cpuLimit	Maximum CPU per MLflow pod	1	No
memoryRequest	Requested memory per MLflow pod	512Mi	No
memoryLimit	Maximum memory per MLflow pod	1Gi	No
servicePort	Port number for MLflow UI and API	5000	No
namespace	Kubernetes namespace	mlflow	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkMlExperiment",
  "parameters": {
    "mlflowVersion": "2.21.3",
    "backendStoreUri": "sqlite:///mlflow/mlflow.db",
    "artifactRoot": "/mlflow/artifacts",
    "replicas": 2,
    "cpuRequest": "250m",
    "cpuLimit": "1",
    "memoryRequest": "512Mi",
    "memoryLimit": "1Gi",
    "servicePort": 5000,
    "namespace": "mlflow"
  }
}

BigData.CaaS.SparkOperator

Spark Operator manages Spark applications as Kubernetes custom resources. Provides cluster-wide Spark job orchestration and monitoring.

Parameter	Description	Example / possible values	Required
operatorVersion	Spark Operator version	2.5.0	No
sparkVersion	Default Spark version used by the operator	3.5.3	No
enableWebhook	Enable Kubernetes webhook for Spark application validation	true	No
enableMetrics	Enable Prometheus metrics collection from Spark jobs	true	No
namespace	Kubernetes namespace for operator deployment	spark-operator	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkOperator",
  "parameters": {
    "operatorVersion": "2.5.0",
    "sparkVersion": "3.5.3",
    "enableWebhook": true,
    "enableMetrics": true,
    "namespace": "spark-operator"
  }
}

BigData.CaaS.SparkUnityCatalog

Unity Catalog metadata layer for Apache Spark, providing centralized governance, data discovery, and access control across data lakes and warehouses.

Parameter	Description	Example / possible values	Required
unityCatalogVersion	Unity Catalog version	0.3.0	No
replicas	Number of Unity Catalog service replicas	2	No
cpuRequest	Requested CPU per pod	250m	No
cpuLimit	Maximum CPU per pod	1	No
memoryRequest	Requested memory per pod	512Mi	No
memoryLimit	Maximum memory per pod	1Gi	No
namespace	Kubernetes namespace	unity-catalog	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "BigData.CaaS.SparkUnityCatalog",
  "parameters": {
    "unityCatalogVersion": "0.3.0",
    "replicas": 2,
    "cpuRequest": "250m",
    "cpuLimit": "1",
    "memoryRequest": "512Mi",
    "memoryLimit": "1Gi",
    "namespace": "unity-catalog"
  }
}

BigData.PaaS.AwsDatabricks

Managed Databricks workspace on AWS. SDK-canonical name for the same offer as BigData.PaaS.Databricks; both route to the same agent handler.

Needs a one-time Databricks account setup before the agent can provision it; see Create a Databricks Workspace.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
accountId	Databricks account ID (cross-account metadata store)	123456789012	Conditional — required on first reconcile unless already published to the accountId output field
pricingTier	Databricks pricing tier	premium (default) or standard	No
credentialsId	AWS credentials configuration identifier registered with Databricks	databricks-creds-id	Yes
storageConfigurationId	AWS storage configuration (S3 bucket) identifier registered with Databricks	storage-config-id	Yes
networkId	VPC network configuration identifier, for a customer-managed private network	net-abc123def456	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.AwsDatabricks",
  "parameters": {
    "accountId": "123456789012",
    "pricingTier": "premium",
    "credentialsId": "databricks-creds-id",
    "storageConfigurationId": "storage-config-id",
    "networkId": "net-abc123def456"
  }
}

BigData.PaaS.AwsDatabricksCluster

Spark compute cluster inside an AWS Databricks workspace. SDK-canonical name for the same offer as BigData.PaaS.DatabricksCluster.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
clusterName	Cluster name as it appears in the workspace. Blank → derived from the component id.	analytics-cluster	No
sparkVersion	Databricks runtime version. Blank → the workspace default.	14.3.x-scala2.12	No
nodeTypeId	EC2 instance type backing each node. Blank → the workspace default.	i3.xlarge	No
numWorkers	Fixed worker count. Ignored when autoscaling bounds are set.	2 (default)	No
minWorkers	Autoscaling floor	1 (default)	No
maxWorkers	Autoscaling ceiling	8 (default)	No
sparkConf	Spark configuration entries applied to the cluster	{"spark.sql.shuffle.partitions": "200"}	No
pypiLibraries	PyPI packages installed on the cluster at start	["pandas==2.2.0"]	No
mavenLibraries	Maven coordinates installed on the cluster at start	["org.apache.spark:spark-avro_2.12:3.5.0"]	No
autoTerminationMinutes	Idle minutes before the cluster shuts itself down	60 (default)	No
dataSecurityMode	Access mode governing Unity Catalog isolation	SINGLE_USER (default), USER_ISOLATION, NONE	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.AwsDatabricksCluster",
  "parameters": {
    "clusterName": "analytics-cluster",
    "sparkVersion": "14.3.x-scala2.12",
    "nodeTypeId": "i3.xlarge",
    "numWorkers": 2,
    "minWorkers": 1,
    "maxWorkers": 8,
    "sparkConf": { "spark.sql.shuffle.partitions": "200" },
    "pypiLibraries": ["pandas==2.2.0"],
    "mavenLibraries": ["org.apache.spark:spark-avro_2.12:3.5.0"],
    "autoTerminationMinutes": 60,
    "dataSecurityMode": "SINGLE_USER"
  }
}

BigData.PaaS.AwsDatabricksJob

Scheduled Databricks job on AWS. SDK-canonical name for the same offer as BigData.PaaS.DatabricksJob. Which artifact parameters are required depends on taskType.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
jobName	Job name as it appears in the workspace. Blank → derived from the component id.	nightly-etl	No
taskType	Task the job runs	NOTEBOOK, PYTHON, SPARK_JAR, python_wheel	No
notebookPath	Workspace path of the notebook to run	/Repos/acme/etl/nightly	Conditional — required for the NOTEBOOK task type
pythonFile	Path or URI of the Python file to run	dbfs:/jobs/etl.py	Conditional — required for the PYTHON task type
mainClassName	Fully-qualified entry class in the JAR	com.acme.etl.Nightly	Conditional — required for the SPARK_JAR task type
jarUri	URI of the JAR to run	s3://acme-artifacts/etl.jar	No
parameters	Positional arguments passed to the task	["--date", "2026-01-01"]	No
cronSchedule	Quartz cron expression for the schedule. Blank → the job runs only when triggered.	0 0 2 * * ?	No
maxRetries	Retry attempts on failure	0 (default)	No
existingCluster	Run on the cluster this job depends on instead of a job cluster	false (default)	No
artifactType	Artifact packaging for the wheel task	wheel	No
artifactUri	URI of the wheel artifact	s3://acme-artifacts/etl-1.0-py3-none-any.whl	No
packageName	Python package name inside the wheel. Blank → the component id.	acme_etl	No
entryPoint	Console-script entry point exposed by the wheel	run-nightly	Conditional — required for the python_wheel task
entryPointArgs	Arguments passed to the wheel entry point	["--full-refresh"]	No
sparkVersion	Databricks runtime for the job cluster	14.3.x-scala2.12 (default)	No
nodeTypeId	EC2 instance type for the job cluster	i3.xlarge (default)	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.AwsDatabricksJob",
  "parameters": {
    "jobName": "nightly-etl",
    "taskType": "python_wheel",
    "artifactType": "wheel",
    "artifactUri": "s3://acme-artifacts/etl-1.0-py3-none-any.whl",
    "packageName": "acme_etl",
    "entryPoint": "run-nightly",
    "entryPointArgs": ["--full-refresh"],
    "parameters": ["--date", "2026-01-01"],
    "cronSchedule": "0 0 2 * * ?",
    "maxRetries": 2,
    "existingCluster": false,
    "sparkVersion": "14.3.x-scala2.12",
    "nodeTypeId": "i3.xlarge"
  }
}

BigData.PaaS.AwsDatabricksMlflow

MLflow experiment inside an AWS Databricks workspace, for tracking runs, parameters, metrics and models. SDK-canonical name for the same offer as BigData.PaaS.DatabricksMlflowExperiment.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
experimentName	Experiment name as it appears in MLflow	churn-model	Yes
artifactLocation	Object-storage location for run artifacts. Blank → the workspace default.	s3://acme-mlflow/churn	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.AwsDatabricksMlflow",
  "parameters": {
    "experimentName": "churn-model",
    "artifactLocation": "s3://acme-mlflow/churn"
  }
}

BigData.PaaS.AwsS3Datalake

S3 bucket used as a data lake: the raw, curated and checkpoint zones a DataProcessingJob reads and writes. Jobs declare which zone they use through a link setting, and the agent injects the matching URI into the job runtime.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
bucket	S3 bucket name backing the lake (globally unique)	acme-datalake-prod	Yes
versioning	Enable object versioning	false (default)	No
forceDestroy	Allow deletion of the bucket while it still holds objects	false (default)	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.AwsS3Datalake",
  "parameters": {
    "bucket": "acme-datalake-prod",
    "versioning": true,
    "forceDestroy": false
  }
}

BigData.PaaS.Databricks

Managed Databricks workspace on AWS. Provides a unified analytics platform for data engineering, data science, and BI workloads.

Needs a one-time Databricks account setup before the agent can provision it; see Create a Databricks Workspace.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
accountId	Databricks account ID (Cross-account metadata store)	123456789012	Conditional — required on first reconcile unless already published to the accountId output field
pricingTier	Databricks pricing tier	premium or standard	No
credentialsId	AWS credentials configuration identifier	databricks-creds-id	Yes
storageConfigurationId	AWS storage configuration (S3 bucket) identifier	storage-config-id	Yes
networkId	VPC network configuration identifier for private networks	``	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.Databricks",
  "parameters": {
    "accountId": "123456789012",
    "pricingTier": "premium",
    "credentialsId": "databricks-creds-id",
    "storageConfigurationId": "storage-config-id",
    "networkId": "net-abc123def456"
  }
}

BigData.PaaS.DatabricksCluster

A Databricks compute cluster for running Spark workloads. Supports autoscaling, data security modes, and custom configurations.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
clusterName	Friendly name for the cluster	prod-cluster	No
sparkVersion	Databricks Runtime version (Spark + extensions)	13.3.x-scala2.12	No
nodeTypeId	AWS instance type for cluster nodes	i3.xlarge	No
numWorkers	Initial number of worker nodes	2	No
minWorkers	Minimum workers for autoscaling	1	No
maxWorkers	Maximum workers for autoscaling	8	No
sparkConf	Spark configuration properties	{}	No
pypiLibraries	List of PyPI package specifications	[]	No
mavenLibraries	List of Maven coordinates for JVM libraries	[]	No
autoTerminationMinutes	Minutes of inactivity before auto-shutdown	60	No
dataSecurityMode	Data security mode for cluster	SINGLE_USER, USER_ISOLATION, NONE	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.DatabricksCluster",
  "parameters": {
    "clusterName": "prod-cluster",
    "sparkVersion": "13.3.x-scala2.12",
    "nodeTypeId": "i3.xlarge",
    "numWorkers": 2,
    "minWorkers": 1,
    "maxWorkers": 8,
    "sparkConf": { "spark.databricks.delta.preview.enabled": "true" },
    "pypiLibraries": ["pandas==2.0.0", "numpy==1.26.0"],
    "mavenLibraries": ["com.amazonaws:aws-java-sdk-s3:1.12.600"],
    "autoTerminationMinutes": 60,
    "dataSecurityMode": "SINGLE_USER"
  }
}

BigData.PaaS.DatabricksJob

A job configured in Databricks for scheduled or triggered task execution. Supports multiple task types: notebook, Python, SQL, JAR, and wheel.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
jobName	Display name for the job	daily-etl	No
taskType	Type of task to execute	NOTEBOOK, PYTHON, SQL, SPARK_JAR, python_wheel	No
notebookPath	Path to notebook for NOTEBOOK task type	/Users/user@example.com/etl_notebook	Conditional — required for the NOTEBOOK task type
pythonFile	Path to Python file for PYTHON task type	s3://bucket/script.py	Conditional — required for the PYTHON task type
mainClassName	Main class for SPARK_JAR task type	com.example.Main	Conditional — required for the SPARK_JAR task type
jarUri	S3 URI to JAR file	s3://bucket/app.jar	No
parameters	Command-line parameters for the task	[]	No
cronSchedule	Cron expression for scheduled execution	0 0 * * *	No
maxRetries	Maximum number of automatic retries	0	No
existingCluster	Use existing cluster ID instead of provisioning	false	No
artifactType	Type of artifact (wheel, jar, etc.)	wheel or jar	No
artifactUri	S3 URI to artifact	s3://bucket/artifact.whl	No
packageName	Package name for wheel artifacts	my_package	No
entryPoint	Entry point function for python_wheel	my_module:main	Conditional — required for the python_wheel task
entryPointArgs	Arguments for the entry point	[]	No
sparkVersion	Spark version for job cluster	14.3.x-scala2.12	No
nodeTypeId	Instance type for job cluster	i3.xlarge	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.DatabricksJob",
  "parameters": {
    "jobName": "daily-etl",
    "taskType": "python_wheel",
    "notebookPath": "/Users/user@example.com/etl_notebook",
    "pythonFile": "s3://bucket/script.py",
    "mainClassName": "com.example.Main",
    "jarUri": "s3://bucket/app.jar",
    "parameters": ["--date", "2026-07-03"],
    "cronSchedule": "0 0 * * *",
    "maxRetries": 0,
    "existingCluster": false,
    "artifactType": "wheel",
    "artifactUri": "s3://bucket/artifact.whl",
    "packageName": "my_package",
    "entryPoint": "my_module:main",
    "entryPointArgs": ["--env", "prod"],
    "sparkVersion": "14.3.x-scala2.12",
    "nodeTypeId": "i3.xlarge"
  }
}

BigData.PaaS.DatabricksMlflowExperiment

An MLflow experiment within Databricks for tracking machine learning runs, metrics, and artifacts.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
experimentName	Fully qualified experiment name in Databricks	/Shared/my-experiment	Yes
artifactLocation	DBFS or S3 path for storing experiment artifacts	/mnt/artifacts or s3://bucket/artifacts	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.DatabricksMlflowExperiment",
  "parameters": {
    "experimentName": "/Shared/my-experiment",
    "artifactLocation": "s3://bucket/artifacts"
  }
}

BigData.PaaS.S3

Amazon S3 object storage bucket for data storage and archival. Supports versioning and lifecycle policies.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
bucket	S3 bucket name (globally unique)	my-data-bucket-12345	Yes
versioning	Enable S3 object versioning	false	No
forceDestroy	Allow deletion of non-empty bucket	false	No

Example (fully parameterized):

{
  "type": "BigData.PaaS.S3",
  "parameters": {
    "bucket": "my-data-bucket-12345",
    "versioning": false,
    "forceDestroy": false
  }
}

BigData.SaaS.Unmanaged

A placeholder for external or pre-existing big data platforms not directly provisioned by Fractal Cloud.

Parameter	Description	Example / possible values	Required
secretName	Name of the secret storing credentials	bigdata-secret	No
secretValue	The secret value (connection string, credentials, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "BigData.SaaS.Unmanaged",
  "parameters": {
    "secretName": "bigdata-secret",
    "secretValue": "secret-content"
  }
}

CustomWorkloads

CustomWorkloads.CaaS.KubernetesWorkload

A Kubernetes workload (Deployment, StatefulSet, DaemonSet, etc.) deployed via GitOps from a Git repository. Supports environment-specific configuration and secret injection.

Parameter	Description	Example / possible values	Required
sshRepositoryURI	SSH URI to the Git repository	git@github.com:org/repo.git	Yes
repoId	Repository identifier for organization/filtering	repo-name	Yes
branchName	Git branch to deploy from	main or production	Yes
privateSSHKeySecretId	Secret ID for Git SSH private key	git-ssh-key-id	No
privateSSHKeyEnvironmentSecretShortName	Environment variable name for SSH key path	SSH_KEY_PATH	No
privateSSHKeyPassphraseSecretId	Secret ID for SSH key passphrase	ssh-passphrase-id	No
privateSSHKeyPassphraseEnvironmentSecretShortName	Environment variable name for SSH passphrase	SSH_PASSPHRASE	No
ciCdProfileShortName	CI/CD profile identifier for build/deploy configuration	default-profile	No
environmentSecretShortNames	List of environment secret identifiers to inject	["db-secret", "api-secret"]	No
roles	List of RBAC roles to assign to the workload	[]	No
workloadSecretIdKey	Secret key name for workload ID	WORKLOAD_ID	No
workloadSecretPasswordKey	Secret key name for workload password	WORKLOAD_PASSWORD	No
workloadIdentityEnabled	Enable Kubernetes workload identity for cloud authentication	true	No
namespace	Kubernetes namespace for deployment	default	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "CustomWorkloads.CaaS.KubernetesWorkload",
  "parameters": {
    "sshRepositoryURI": "git@github.com:org/repo.git",
    "repoId": "repo-name",
    "branchName": "main",
    "privateSSHKeySecretId": "git-ssh-key-id",
    "privateSSHKeyEnvironmentSecretShortName": "SSH_KEY_PATH",
    "privateSSHKeyPassphraseSecretId": "ssh-passphrase-id",
    "privateSSHKeyPassphraseEnvironmentSecretShortName": "SSH_PASSPHRASE",
    "ciCdProfileShortName": "default-profile",
    "environmentSecretShortNames": ["db-secret", "api-secret"],
    "roles": ["viewer", "deployer"],
    "workloadSecretIdKey": "WORKLOAD_ID",
    "workloadSecretPasswordKey": "WORKLOAD_PASSWORD",
    "workloadIdentityEnabled": true,
    "namespace": "default"
  }
}

CustomWorkloads.FaaS.AwsLambda

AWS Lambda serverless function for event-driven compute. Supports container images and ZIP packages with configurable runtime, memory, and timeout.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
functionName	Name of the Lambda function	my-function	No
runtime	Execution runtime	java21, python3.11, nodejs20.x	No
handler	Handler function for ZIP packages	index.handler or com.example.Handler::handleRequest	Conditional — required for the zip-packaged path
roleArn	IAM role ARN for Lambda execution	arn:aws:iam::123456789012:role/lambda-role	Conditional — required unless the environment supplies a Lambda execution role
sourceArtifact	OCI artifact reference (image URI or S3 location)	123456789012.dkr.ecr.us-east-1.amazonaws.com/my-func:latest	Conditional — required unless the legacy codeBase64 inline zip is supplied
packageType	Package type classification	image or zip	No
codeBase64	Base64-encoded ZIP file (deprecated)	UEsDBAoAA...	Conditional — deprecated legacy inline zip source; required unless sourceArtifact is supplied
environment	Environment variables passed to the function	{"DB_HOST": "localhost"}	No
memoryMb	Memory allocation for function	128 to 10240	No
timeoutSeconds	Maximum execution time	3 to 900	No

Example (fully parameterized):

{
  "type": "CustomWorkloads.FaaS.AwsLambda",
  "parameters": {
    "functionName": "my-function",
    "runtime": "java21",
    "handler": "com.example.Handler::handleRequest",
    "roleArn": "arn:aws:iam::123456789012:role/lambda-role",
    "sourceArtifact": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-func:latest",
    "packageType": "image",
    "codeBase64": "UEsDBAoAAAAAAA...",
    "environment": { "DB_HOST": "localhost" },
    "memoryMb": 128,
    "timeoutSeconds": 3
  }
}

CustomWorkloads.PaaS.AwsEcsService

Long-running container workload on Amazon ECS. One blueprint workload maps to two live-system components: an ECS task definition (id ${workload.id}-task, carrying the image and sizing) and this service (id ${workload.id}, carrying the cluster and subnet dependencies plus the links), with the service depending on the task definition.

Phantom component

This offer provisions no infrastructure of its own. It exists so a Workload blueprint can say "run me as this cloud's managed container service" while keeping the dependency graph uniform across providers. The agent marks it Active on instantiation and Deleted on removal so dependents can proceed; the real resources come from the sub-components listed below.

Image, sizing, ports, replicas and environment are carried on the task definition (NetworkAndCompute.CaaS.ECSTaskDefinition); the running service is NetworkAndCompute.CaaS.ECSService. This component depends on those and carries the workload's links.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No

Example:

{
  "type": "CustomWorkloads.PaaS.AwsEcsService",
  "parameters": {}
}

CustomWorkloads.SaaS.Unmanaged

A placeholder for external or pre-existing serverless/workload platforms not directly provisioned by Fractal Cloud.

Parameter	Description	Example / possible values	Required
secretName	Name of the secret storing credentials	workload-secret	No
secretValue	The secret value (credentials, API key, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "CustomWorkloads.SaaS.Unmanaged",
  "parameters": {
    "secretName": "workload-secret",
    "secretValue": "secret-content"
  }
}

Messaging

Messaging.CaaS.Kafka

Apache Kafka message broker on Kubernetes for high-throughput, durable publish-subscribe messaging. Includes storage, replication, and consumer group management.

Parameter	Description	Example / possible values	Required
replicas	Number of Kafka broker replicas in the cluster	5	No
kafkaVersion	Kafka version	4.2.0	No
memoryRequest	Requested memory per Kafka broker pod	16Gi	No
memoryLimit	Maximum memory per Kafka broker pod	32Gi	No
cpuRequest	Requested CPU per Kafka broker pod	4	No
cpuLimit	Maximum CPU per Kafka broker pod	8	No
storageSize	Size of persistent storage per broker	1Ti	No
namespace	Kubernetes namespace	kafka	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Messaging.CaaS.Kafka",
  "parameters": {
    "replicas": 5,
    "kafkaVersion": "4.2.0",
    "memoryRequest": "16Gi",
    "memoryLimit": "32Gi",
    "cpuRequest": "4",
    "cpuLimit": "8",
    "storageSize": "1Ti",
    "namespace": "kafka"
  }
}

Messaging.CaaS.KafkaTopic

A Kafka topic for organizing messages by subject or stream. Configurable partitions, replication factor, and retention policies.

Parameter	Description	Example / possible values	Required
partitions	Number of partitions for parallel processing	50	No
replicas	Replication factor for durability	2	No
retentionMs	Message retention period in milliseconds	172800000 (2 days)	No
clusterName	Name of the Kafka cluster this topic belongs to	kafka-cluster	Yes
namespace	Kubernetes namespace	kafka	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Messaging.CaaS.KafkaTopic",
  "parameters": {
    "partitions": 50,
    "replicas": 2,
    "retentionMs": 172800000,
    "clusterName": "kafka-cluster",
    "namespace": "kafka"
  }
}

Messaging.CaaS.KafkaUser

A Kafka user account with ACL (Access Control List) permissions. Configures authentication and authorization for client access.

Parameter	Description	Example / possible values	Required
acls	List of ACL rules defining topic/group access	[]	No
clusterName	Name of the Kafka cluster	kafka-cluster	Yes
namespace	Kubernetes namespace	kafka	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Messaging.CaaS.KafkaUser",
  "parameters": {
    "acls": [],
    "clusterName": "kafka-cluster",
    "namespace": "kafka"
  }
}

Messaging.SaaS.Unmanaged

A placeholder for external or pre-existing messaging platforms not directly provisioned by Fractal Cloud.

Parameter	Description	Example / possible values	Required
secretName	Name of the secret storing credentials	messaging-secret	No
secretValue	The secret value (connection string, credentials, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "Messaging.SaaS.Unmanaged",
  "parameters": {
    "secretName": "messaging-secret",
    "secretValue": "secret-content"
  }
}

NetworkAndCompute

NetworkAndCompute.CaaS.ECSService

AWS ECS (Elastic Container Service) service that manages containerized workload replicas across an ECS cluster. Handles task placement and scaling.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
desiredCount	Number of task replicas to maintain	1	No
launchType	Compute launch type	FARGATE, EC2	No
assignPublicIp	Assign public IP addresses to tasks	false	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.CaaS.ECSService",
  "parameters": {
    "desiredCount": 1,
    "launchType": "FARGATE",
    "assignPublicIp": false
  }
}

NetworkAndCompute.CaaS.ECSTaskDefinition

ECS task definition that specifies container images, resource allocation, logging, and environment configuration for containerized tasks.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
cpu	CPU units allocated per task	256, 512, 1024, 2048	No
memory	Memory in MB allocated per task	512, 1024, 2048	No
networkMode	Docker network mode	bridge, host, awsvpc	No
containerName	Name of the container within the task	app-container	No
containerImage	Container image URI	123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:latest	No
containerPort	Port number exposed by the container	8080	No
executionRoleArn	IAM role ARN for ECS task execution	arn:aws:iam::123456789012:role/ecsTaskExecutionRole	No
taskRoleArn	IAM role ARN for application inside container	arn:aws:iam::123456789012:role/ecsTaskRole	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.CaaS.ECSTaskDefinition",
  "parameters": {
    "cpu": "256",
    "memory": "512",
    "networkMode": "awsvpc",
    "containerName": "app-container",
    "containerImage": "123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:latest",
    "containerPort": 8080,
    "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
    "taskRoleArn": "arn:aws:iam::123456789012:role/ecsTaskRole"
  }
}

NetworkAndCompute.IaaS.AwsLoadBalancer

AWS Elastic Load Balancer (ALB/NLB) for distributing traffic across targets. Supports multiple availability zones and health checking.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
lbType	Load balancer type	application (ALB), network (NLB), classic (ELB)	No
lbScheme	Load balancer scheme	internet-facing, internal	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AwsLoadBalancer",
  "parameters": {
    "lbType": "application",
    "lbScheme": "internet-facing"
  }
}

NetworkAndCompute.IaaS.AwsSecurityGroup

AWS security group for controlling inbound and outbound network traffic. Framework-managed; custom rules are derived from component links.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
description	Human-readable description of the security group	Web tier access	No
ingressRules	Pre-defined ingress rules (custom rules via links)	[]	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AwsSecurityGroup",
  "parameters": {
    "description": "Web tier access",
    "ingressRules": []
  }
}

NetworkAndCompute.IaaS.AwsSubnet

AWS VPC subnet for logical network segmentation. Configurable CIDR block and availability zone.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
cidrBlock	CIDR block for the subnet	10.0.1.0/24	No
availabilityZone	AWS availability zone	us-east-1a	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AwsSubnet",
  "parameters": {
    "cidrBlock": "10.0.1.0/24",
    "availabilityZone": "us-east-1a"
  }
}

NetworkAndCompute.IaaS.AwsVpc

AWS Virtual Private Cloud for network isolation and control. Provides the foundation for all VPC-based resources.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
cidrBlock	CIDR block for the VPC	10.0.0.0/16	No
enableDnsSupport	Enable DNS resolution within the VPC	true	No
enableDnsHostnames	Enable DNS hostnames for EC2 instances	true	No
instanceTenancy	VPC tenancy mode	default, dedicated, host	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.AwsVpc",
  "parameters": {
    "cidrBlock": "10.0.0.0/16",
    "enableDnsSupport": true,
    "enableDnsHostnames": true,
    "instanceTenancy": "default"
  }
}

NetworkAndCompute.IaaS.EC2

AWS EC2 virtual machine instance. Configurable instance type, AMI, and network settings.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
amiId	Amazon Machine Image ID	ami-0a123456789abcdef	Yes
instanceType	EC2 instance type	t3.medium, m5.large, c5.xlarge	Yes
keyName	EC2 key pair name for SSH access	my-keypair	No
userData	User data script (base64 or plain text)	#!/bin/bash\necho "Hello"	No
iamInstanceProfile	IAM instance profile name/ARN	ec2-app-profile	No
associatePublicIp	Assign public IP address to instance	false	No
identity	Workload identity to attach, so software on the instance reaches cloud services without injected keys. Least-privilege by default.	{"instanceProfile": "acme-app-profile"}	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.IaaS.EC2",
  "parameters": {
    "amiId": "ami-0a123456789abcdef",
    "instanceType": "t3.medium",
    "keyName": "my-keypair",
    "userData": "#!/bin/bash\necho \"Hello\"",
    "iamInstanceProfile": "ec2-app-profile",
    "associatePublicIp": false
  }
}

NetworkAndCompute.PaaS.AwsEc2Instance

EC2 instance. SDK-canonical name for the same offer as NetworkAndCompute.IaaS.EC2; both route to the same agent handler. Depends on the subnet it is placed in, and links to security groups for membership.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
amiId	AMI to launch. Unset → the latest Amazon Linux 2023 AMI, resolved dynamically at create time.	ami-0abcdef1234567890	No
instanceType	EC2 instance type	t3.micro, m6i.large	No
keyName	Name of an existing EC2 key pair to authorize	acme-bastion	No
userData	Cloud-init script run at first boot	#!/bin/bash\nyum install -y nginx	No
iamInstanceProfile	IAM instance profile to attach. Prefer identity below, which lets the agent create and attach one.	acme-app-profile	No
associatePublicIp	Attach a public IP to the instance	false (default)	No
identity	Workload identity to attach, so software on the box reaches AWS services without injected keys. Least-privilege by default.	{"instanceProfile": "acme-app-profile"}	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AwsEc2Instance",
  "parameters": {
    "amiId": "ami-0abcdef1234567890",
    "instanceType": "t3.micro",
    "keyName": "acme-bastion",
    "userData": "#!/bin/bash\nyum install -y nginx",
    "associatePublicIp": false,
    "identity": { "instanceProfile": "acme-app-profile" }
  }
}

NetworkAndCompute.PaaS.AwsEks

Amazon EKS cluster. SDK-canonical name for the same offer as NetworkAndCompute.PaaS.EKS; both route to the same agent handler.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
kubernetesVersion	Control-plane version. Blank → the EKS default.	1.30	No
networkPolicyProvider	Network policy implementation to install	calico	No
nodePools	Node group topology. Empty → a single managed default pool.	[{"name": "default", "minNodeCount": 2, "maxNodeCount": 6, "autoscalingEnabled": true}]	No
workloadIdentityEnabled	Enable IRSA / EKS Pod Identity so pods assume IAM roles without static keys	true (default)	No
privateClusterDisabled	Expose the API server publicly. Leave false for a private-only control plane.	false (default)	No
serviceIpRange	Explicit CIDR for cluster services. Blank → allocated by IPAM in spoke mode.	10.100.0.0/16	No
podIpRange	Explicit CIDR for pods. Blank → allocated by IPAM in spoke mode.	10.101.0.0/16	No
podCidrPrefixLength	Prefix length requested from IPAM for the pod range	20 (default)	No
serviceCidrPrefixLength	Prefix length requested from IPAM for the service range	20 (default)	No
addons	EKS add-ons to install	["vpc-cni", "coredns", "kube-proxy"]	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AwsEks",
  "parameters": {
    "kubernetesVersion": "1.30",
    "networkPolicyProvider": "calico",
    "nodePools": [
      { "name": "default", "minNodeCount": 2, "maxNodeCount": 6, "autoscalingEnabled": true }
    ],
    "workloadIdentityEnabled": true,
    "privateClusterDisabled": false,
    "podCidrPrefixLength": 20,
    "serviceCidrPrefixLength": 20,
    "addons": ["vpc-cni", "coredns", "kube-proxy"]
  }
}

NetworkAndCompute.PaaS.AwsLb

Elastic Load Balancer. SDK-canonical name for the same offer as NetworkAndCompute.IaaS.AwsLoadBalancer; both route to the same agent handler. Depends on its subnets and links to its backend compute components for target registration.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
lbType	Load balancer flavour	application (default), network	No
lbScheme	Whether the load balancer is reachable from the internet. Blank → internal.	internet-facing, internal	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.AwsLb",
  "parameters": {
    "lbType": "application",
    "lbScheme": "internet-facing"
  }
}

NetworkAndCompute.PaaS.ECS

AWS ECS cluster providing the orchestration platform for containerized workloads. Manages compute capacity and task scheduling.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.ECS",
  "parameters": {}
}

NetworkAndCompute.PaaS.EKS

AWS Elastic Kubernetes Service (EKS) for managed Kubernetes orchestration. Handles control plane operations and node provisioning.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
kubernetesVersion	Kubernetes version	1.28, 1.29, 1.30	No
networkPolicyProvider	Network policy enforcement	calico, cilium, aws-vpc-cni	No
nodePools	List of node pool configurations	[]	No
workloadIdentityEnabled	Enable IRSA (IAM Roles for Service Accounts)	true	No
privateClusterDisabled	Disable private endpoint access to control plane	false	No
serviceIpRange	CIDR range for Kubernetes services	10.100.0.0/16	No
addons	List of EKS add-ons to install	["vpc-cni", "kube-proxy", "coredns"]	No
podIpRange	Explicit CIDR for pods. Blank → allocated by IPAM in spoke mode.	10.101.0.0/16	No
podCidrPrefixLength	Prefix length requested from IPAM for the pod range	20 (default)	No
serviceCidrPrefixLength	Prefix length requested from IPAM for the service range	20 (default)	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.EKS",
  "parameters": {
    "kubernetesVersion": "1.30",
    "networkPolicyProvider": "aws-vpc-cni",
    "nodePools": [],
    "workloadIdentityEnabled": true,
    "privateClusterDisabled": false,
    "serviceIpRange": "10.100.0.0/16",
    "addons": ["vpc-cni", "kube-proxy", "coredns"]
  }
}

NetworkAndCompute.PaaS.Kubernetes

Generic Kubernetes cluster specification. Supports EKS and other managed Kubernetes services with consistent configuration.

Parameter	Description	Example / possible values	Required
kubernetesVersion	Kubernetes version	1.28, 1.29, 1.30	No
networkPolicyProvider	Network policy enforcement	calico, cilium, aws-vpc-cni	No
nodePools	List of node pool configurations	[]	No
workloadIdentityEnabled	Enable workload identity for pod authentication	true	No
privateClusterDisabled	Disable private endpoint access to control plane	false	No
serviceIpRange	CIDR range for Kubernetes services	10.100.0.0/16	No
addons	List of add-ons to install	[]	No
podIpRange	Explicit CIDR for pods. Blank → allocated by IPAM in spoke mode.	10.101.0.0/16	No
podCidrPrefixLength	Prefix length requested from IPAM for the pod range	20 (default)	No
serviceCidrPrefixLength	Prefix length requested from IPAM for the service range	20 (default)	No

Example (fully parameterized):

{
  "type": "NetworkAndCompute.PaaS.Kubernetes",
  "parameters": {
    "kubernetesVersion": "1.30",
    "networkPolicyProvider": "calico",
    "nodePools": [],
    "workloadIdentityEnabled": true,
    "privateClusterDisabled": false,
    "serviceIpRange": "10.100.0.0/16",
    "addons": ["vpc-cni", "kube-proxy", "coredns"]
  }
}

NetworkAndCompute.SaaS.Unmanaged

A placeholder for external or pre-existing compute/network solutions not directly provisioned by Fractal Cloud.

Parameter	Description	Example / possible values	Required
secretName	Name of the secret storing credentials	network-secret	No
secretValue	The secret value (credentials, connection string, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "NetworkAndCompute.SaaS.Unmanaged",
  "parameters": {
    "secretName": "network-secret",
    "secretValue": "secret-content"
  }
}

Observability

Observability.CaaS.Jaeger

Jaeger v2 distributed tracing on Kubernetes. Jaeger keeps no datastore of its own: it stores traces in an OpenSearch cluster (Storage.CaaS.OpenSearch) that it links to, and it also depends on that component so it is reconciled only once OpenSearch is Active. Exactly one OpenSearch link is required; a Jaeger component without one is refused with a message naming the remedy. The OpenSearch component may live in another Live System of the environment, through a reference.

The link carries access: read-write and indexPrefix: <jaegerId>-jaeger-. The OpenSearch component creates Jaeger's own user, scoped to that prefix, and places its password and CA certificate in a Kubernetes Secret in Jaeger's namespace; Jaeger mounts both. The old storageSettings and storageClassName parameters are no longer read: a component that still sets them is refused with a message pointing at the OpenSearch link.

Parameter	Description	Example / possible values	Required
namespace	Kubernetes namespace. Unset → derived from the component id.	jaeger	No
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Link settings (Jaeger → OpenSearch):

Setting	Description	Value	Required
access	Scope of the OpenSearch role granted to Jaeger	read-write	Yes
indexPrefix	Index prefix Jaeger writes under	<jaegerId>-jaeger-	No

Output fields: frontendUri, version, namespace, serviceName, otlpGrpcEndpoint, otlpHttpEndpoint, collectorEndpoint.

Example (fully parameterized):

{
  "id": "tracing",
  "type": "Observability.CaaS.Jaeger",
  "parameters": {
    "namespace": "jaeger"
  },
  "dependencies": ["search"],
  "links": [
    { "componentId": "search", "settings": { "access": "read-write", "indexPrefix": "tracing-jaeger-" } }
  ]
}

Observability.CaaS.Prometheus

Prometheus monitoring server on Kubernetes for scraping metrics and triggering alerts based on time-series data.

Parameter	Description	Example / possible values	Required
grafanaConfigSecretId	Secret ID containing Grafana configuration	grafana-config-secret	No
namespace	Kubernetes namespace	prometheus	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Observability.CaaS.Prometheus",
  "parameters": {
    "grafanaConfigSecretId": "grafana-config-secret",
    "namespace": "prometheus"
  }
}

Observability.SaaS.Jaeger

Managed Jaeger service (e.g., Jaeger Cloud) for distributed tracing as a managed service.

Parameter	Description	Example / possible values	Required
frontendUri	URI to the Jaeger UI	https://jaeger.example.com	Yes
version	Jaeger version	1.48.0	Yes

Example (fully parameterized):

{
  "type": "Observability.SaaS.Jaeger",
  "parameters": {
    "frontendUri": "https://jaeger.example.com",
    "version": "1.48.0"
  }
}

Observability.SaaS.Prometheus

Managed Prometheus service (e.g., AWS AMP - Amazon Managed Prometheus) for metrics collection and querying.

Parameter	Description	Example / possible values	Required
apiGatewayUrl	API endpoint for metrics ingestion and queries	https://aps.us-east-1.amazonaws.com/	Yes
grafanaConfigSecretId	Secret ID containing Grafana datasource configuration	grafana-amp-config	Yes

Example (fully parameterized):

{
  "type": "Observability.SaaS.Prometheus",
  "parameters": {
    "apiGatewayUrl": "https://aps.us-east-1.amazonaws.com/",
    "grafanaConfigSecretId": "grafana-amp-config"
  }
}

Security

Security.CaaS.Ocelot

Ocelot API gateway on Kubernetes providing routing, authentication, rate limiting, and request/response transformation.

Parameter	Description	Example / possible values	Required
host	Hostname for the Ocelot gateway	api.example.com	Yes
corsOrigins	List of allowed CORS origins	["https://example.com", "https://app.example.com"]	No
cookieMaxAgeSec	Session cookie max age in seconds	900	No
pathPrefix	URL path prefix for routing	/* or /api/*	No
roles	List of authorization roles	[]	No
namespace	Kubernetes namespace	ocelot	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Security.CaaS.Ocelot",
  "parameters": {
    "host": "api.example.com",
    "corsOrigins": ["https://example.com", "https://app.example.com"],
    "cookieMaxAgeSec": 900,
    "pathPrefix": "/*",
    "roles": ["admin", "user"],
    "namespace": "ocelot"
  }
}

Security.PaaS.AwsCognito

Amazon Cognito User Pool — the AWS implementation of the Identity Provider component. Provisions a user directory (pool) with configurable MFA and password guardrails. App clients are not configured here: each inbound link from a Workload or gateway provisions exactly one app client (see below). A pool with zero links is a valid bare pool.

Parameter	Description	Example / possible values	Required
region	AWS region the pool is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
userDirectoryName	User pool name. Blank → the component id.	customers	No
mfaConfiguration	Multi-factor authentication enforcement.	OFF (default), OPTIONAL, ON	No
passwordPolicy	Password guardrail object: minLength plus optional requireUppercase / requireLowercase / requireNumbers / requireSymbols booleans (omitted → Cognito default).	{"minLength": 8, "requireSymbols": true}	No
sessionDuration	Token / session duration in seconds.	3600 (default)	No

Example (fully parameterized):

{
  "type": "Security.PaaS.AwsCognito",
  "parameters": {
    "region": "eu-central-1",
    "userDirectoryName": "customers",
    "mfaConfiguration": "OPTIONAL",
    "passwordPolicy": { "minLength": 12, "requireUppercase": true, "requireNumbers": true, "requireSymbols": true },
    "sessionDuration": 3600
  }
}

App clients (provisioned per link). A Workload or gateway component links to this provider to become an OAuth client; each link provisions one app client shaped by clientType (web, spa, or machine), with redirectUris / logoutUris / scopes taken from the link settings. The guardrails above cap what any client may request. The pool publishes oidcIssuerUrl, jwksUri, and each created clientId as output fields; the agent injects OIDC_ISSUER_URI, OIDC_CLIENT_ID, OIDC_JWKS_URI, OIDC_SCOPES, and — for confidential (web / machine) clients — OIDC_CLIENT_SECRET_REF into the linked consumer. The raw client secret is stored in AWS Secrets Manager and never placed in output fields.

Security.SaaS.Unmanaged

A placeholder for external or pre-existing security solutions not directly provisioned by Fractal Cloud.

Parameter	Description	Example / possible values	Required
secretName	Name of the secret storing credentials	security-secret	No
secretValue	The secret value (credentials, API key, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "Security.SaaS.Unmanaged",
  "parameters": {
    "secretName": "security-secret",
    "secretValue": "secret-content"
  }
}

Storage

Storage.CaaS.CnpgCluster

CloudNativePG (CNPG) PostgreSQL cluster on Kubernetes. Provides HA PostgreSQL with automated backup, recovery, and failover.

Parameter	Description	Example / possible values	Required
instances	Number of PostgreSQL replicas	3	No
postgresqlVersion	PostgreSQL version	17.2	No
storageSize	Persistent volume size per instance	10Gi	No
storageClass	Kubernetes storage class	cluster default	No
cpuRequest	Requested CPU per PostgreSQL pod	500m	No
cpuLimit	Maximum CPU per PostgreSQL pod	1	No
memoryRequest	Requested memory per PostgreSQL pod	512Mi	No
memoryLimit	Maximum memory per PostgreSQL pod	1Gi	No
database	Default database name	app	No
databaseOwner	Default database owner user	app	No
enableSuperuserAccess	Enable superuser access for the database owner	false	No
namespace	Kubernetes namespace	cnpg	Yes
age	Enable age-based encryption of the CloudNativePG backup credentials	false (default)	No
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Storage.CaaS.CnpgCluster",
  "parameters": {
    "instances": 3,
    "postgresqlVersion": "17.2",
    "storageSize": "10Gi",
    "storageClass": "gp3",
    "cpuRequest": "500m",
    "cpuLimit": "1",
    "memoryRequest": "512Mi",
    "memoryLimit": "1Gi",
    "database": "app",
    "databaseOwner": "app",
    "enableSuperuserAccess": false,
    "namespace": "cnpg"
  }
}

Storage.CaaS.CnpgDatabase

A database within a CNPG PostgreSQL cluster. Configurable name, owner, and locale settings.

Parameter	Description	Example / possible values	Required
databaseName	Name of the database	app or myapp_prod	No
databaseOwner	Database owner user name	app_user	No
encoding	Character encoding	UTF8, LATIN1	No
localeCollate	Collation locale	en_US.UTF-8	No
localeCType	Character type locale	en_US.UTF-8	No
cnpgClusterName	Name of the parent CNPG cluster	postgres-cluster	Yes
namespace	Kubernetes namespace	cnpg	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Storage.CaaS.CnpgDatabase",
  "parameters": {
    "databaseName": "app",
    "databaseOwner": "app",
    "encoding": "UTF8",
    "localeCollate": "en_US.UTF-8",
    "localeCType": "en_US.UTF-8",
    "cnpgClusterName": "postgres-cluster",
    "namespace": "cnpg"
  }
}

Storage.CaaS.MinioTenant

MinIO object storage tenant on Kubernetes for S3-compatible distributed storage.

Parameter	Description	Example / possible values	Required
minioVersion	MinIO release version	RELEASE.2025-03-12T18-04-18Z	No
servers	Number of MinIO servers	4	No
volumesPerServer	Number of volumes per server	4	No
volumeSize	Storage volume size	100Gi	No
storageClass	Kubernetes storage class	cluster default	No
cpuRequest	Requested CPU per server	500m	No
cpuLimit	Maximum CPU per server	2	No
memoryRequest	Requested memory per server	1Gi	No
memoryLimit	Maximum memory per server	4Gi	No
requestAutoCert	Auto-generate TLS certificates	true	No
namespace	Kubernetes namespace	minio	Yes
containerPlatform	Deprecated. The target cluster is derived from this component's dependency on the Kubernetes cluster; accepted only as a backward-compat fallback.	my-cluster	No

Example (fully parameterized):

{
  "type": "Storage.CaaS.MinioTenant",
  "parameters": {
    "minioVersion": "RELEASE.2025-03-12T18-04-18Z",
    "servers": 4,
    "volumesPerServer": 4,
    "volumeSize": "100Gi",
    "storageClass": "gp3",
    "cpuRequest": "500m",
    "cpuLimit": "2",
    "memoryRequest": "1Gi",
    "memoryLimit": "4Gi",
    "requestAutoCert": true,
    "namespace": "minio"
  }
}

Storage.CaaS.OpenSearch

OpenSearch (Apache 2.0) search and analytics cluster on Kubernetes, installed from the opensearch-project Helm chart, with optional OpenSearch Dashboards. Depends on a NetworkAndCompute.PaaS.Kubernetes cluster.

Migrating from Elastic

The Elastic offers are retired. Elastic components already deployed keep running, unmanaged; see Migrate from Elastic for what changes and how to move to OpenSearch.

The security plugin is always on. No demo certificates and no default admin password are used: the agent generates the admin password and a private CA with node and HTTP certificates, and keeps them in Kubernetes Secrets in the component's namespace.

Parameter	Description	Example / possible values	Required
namespace	Kubernetes namespace	opensearch (default)	No
replicas	Number of OpenSearch nodes	3 (default)	No
storage	Persistent volume size per node	100Gi (default)	No
storageClassName	Kubernetes storage class for the node volumes	cluster default	No
memory	Container memory request and limit per node	4Gi	No
cpu	Container CPU per node	2	No
dashboards	Install OpenSearch Dashboards	false (default), true	No
values	Helm values deep-merged over the generated ones	{}	No

Output fields:

Field	Value
namespace, releaseName, chartVersion, version	Release coordinates and OpenSearch version
serviceName	The HTTP service
host	<serviceName>.<namespace>.svc.cluster.local
port	9200
url	https://<host>:9200
adminSecretName	Secret holding the admin password (key password)
caSecretName	Secret holding the CA certificate (key ca.crt)
dashboardsUrl	Only when dashboards is true

Link settings (consumer → OpenSearch). A CustomWorkloads.CaaS.KubernetesWorkload or an Observability.CaaS.Jaeger links to this component to use it, from the same Live System or from another Live System of the environment. The OpenSearch component does the link work: it creates one internal user per consumer with one role scoped to the index pattern <indexPrefix>* (never all_access), and writes that user's password and the CA certificate into a Kubernetes Secret in the consumer's namespace (keys password and ca.crt). An existing secret or user of the same name that Fractal did not create is never taken over: the link is refused. Removing the link or the consumer removes the user, its role and the secret. The raw password is never placed in output fields.

Setting	Description	Example / possible values	Required
access	Scope of the consumer's role. No default. The catalogue spelling accessMode (read / write / readWrite) is accepted; access wins.	read, write, read-write	Yes
indexPrefix	Index prefix the role covers. Lower-case letters, digits, -, _ and . only; no wildcards.	<consumerId>- (default)	No

A Kubernetes workload consumer receives SEARCH_URL, SEARCH_USERNAME, SEARCH_PASSWORD_REF, SEARCH_INDEX_PREFIX and SEARCH_CA_REF (the name of the secret holding ca.crt).

Example (fully parameterized):

{
  "id": "search",
  "type": "Storage.CaaS.OpenSearch",
  "parameters": {
    "namespace": "opensearch",
    "replicas": 3,
    "storage": "100Gi",
    "storageClassName": "gp3",
    "memory": "4Gi",
    "cpu": "2",
    "dashboards": true,
    "values": {}
  }
}

Storage.PaaS.AwsRdsPostgres

Amazon RDS for PostgreSQL. One offer covers both shapes RDS provides, selected by mode: an Aurora cluster with Serverless v2 members (aurora-serverless, the default) or a single provisioned instance (provisioned-instance). Both publish the same connection output fields, so moving between them changes nothing for a linked consumer.

The security posture is not configurable — encryption at rest, private-only networking, IAM database authentication, CloudWatch log export and automatic minor upgrades are always applied. The master credential is created and held by RDS itself, so the agent never holds it: only masterUserSecretArn is published, and each linked consumer gets its own PostgreSQL role with its password in Secrets Manager.

Availability, durability and capacity defaults come from the environment type rather than from a fixed constant — a personal environment gets a single-AZ, no-reader, 1-day-retention sandbox profile; an organizational one gets a reader in a second zone, Multi-AZ and 14-day retention. The applied profile is published as the haProfile output field. An explicit parameter always wins over the profile, in both directions.

With no Subnet dependencies the agent places the database across the environment spoke's per-AZ private subnets. Declare Subnet dependencies to override that; a spoke offering fewer than two Availability Zones fails, because a DB subnet group must span at least two.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
mode	Which RDS shape to provision	aurora-serverless (default), provisioned-instance	No
version	PostgreSQL major version. RDS resolves it to the latest supported minor at create time.	16 (default)	No
instanceClass	Instance class for cluster members or the provisioned instance. Aurora Serverless v2 always uses db.serverless.	db.t4g.micro, db.t4g.medium	Conditional — default depends on the environment type
administratorLogin	Master username RDS creates	fractaladmin (default)	No
allocatedStorageGb	Initial storage. Provisioned mode only.	20 (default)	No
maxAllocatedStorageGb	Ceiling storage autoscaling grows to. Provisioned mode only.	100 (default)	No
minAcu	Aurora Serverless v2 capacity floor, in Aurora Capacity Units	0.5	Conditional — default depends on the environment type
maxAcu	Aurora Serverless v2 capacity ceiling, in Aurora Capacity Units	2, 8	Conditional — default depends on the environment type
readerCount	Aurora reader members. Aurora mode only, capped at 15 by AWS.	0, 1	Conditional — default depends on the environment type
multiAz	Provision a standby in a second zone. Provisioned mode only.	true, false	Conditional — default depends on the environment type
backupRetentionDays	Automated backup retention window	1, 14	Conditional — default depends on the environment type
deletionProtection	Refuse to delete the cluster or instance	false (default)	No
port	Listener port	5432 (default)	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.AwsRdsPostgres",
  "parameters": {
    "mode": "aurora-serverless",
    "version": "16",
    "instanceClass": "db.serverless",
    "administratorLogin": "fractaladmin",
    "minAcu": 0.5,
    "maxAcu": 8,
    "readerCount": 1,
    "backupRetentionDays": 14,
    "deletionProtection": true,
    "port": 5432
  }
}

Storage.PaaS.AwsRdsPostgresDatabase

A logical PostgreSQL database inside an Storage.PaaS.AwsRdsPostgres DBMS. Added under its DBMS as a child component, so it is never offer-selected independently — swapping the DBMS offer swaps the database's vendor family with it.

A consumer links to this database with an access setting; the agent grants it its own PostgreSQL role — never a shared one, never the master — and injects DB_HOST, DB_PORT, DB_NAME, DB_USERNAME and DB_PASSWORD_REF. The raw password is never placed in output fields.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
databaseName	Database name. Unset → the component id mapped onto a legal PostgreSQL identifier.	orders	No
schema	Schema created and set as the default search path	public (default)	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.AwsRdsPostgresDatabase",
  "parameters": {
    "databaseName": "orders",
    "schema": "public"
  }
}

Storage.PaaS.AwsS3

Amazon S3 object storage bucket. SDK-canonical name for the same offer as Storage.PaaS.S3; both route to the same agent handler.

A compute consumer links to the bucket with an access setting (read, write, read-write); the agent ensures the consumer has an identity, grants that identity a bucket policy scoped to that access, and publishes the bucket URI to the consumer.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
bucket	S3 bucket name (globally unique)	my-data-bucket-12345	Yes
versioning	Enable object versioning	false (default)	No
forceDestroy	Allow deletion of the bucket while it still holds objects	false (default)	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.AwsS3",
  "parameters": {
    "bucket": "my-data-bucket-12345",
    "versioning": false,
    "forceDestroy": false
  }
}

Storage.PaaS.PostgreSqlDatabase

A logical PostgreSQL database inside a Storage.PaaS.PostgreSqlDbms. Added under its DBMS as a child component, so it is not offer-selected independently — swapping the DBMS offer swaps the database's vendor family with it.

A consumer links to this database with an access setting; the agent grants it its own PostgreSQL role — never a shared one, never the master — and injects DB_HOST, DB_PORT, DB_NAME, DB_USERNAME and DB_PASSWORD_REF. The raw password is never placed in output fields.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
databaseName	Database name created inside the DBMS	app (default)	No
schema	Schema created and set as the default search path	public (default)	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.PostgreSqlDatabase",
  "parameters": {
    "databaseName": "orders",
    "schema": "public"
  }
}

Storage.PaaS.PostgreSqlDbms

Vendor-neutral type name for a managed PostgreSQL server. On AWS it routes to the same agent handler as Storage.PaaS.AwsRdsPostgres and reads the same parameters — mode selects an Aurora Serverless v2 cluster or a single provisioned instance.

The security posture is not configurable: encryption at rest, private-only networking, IAM database authentication, CloudWatch log export and automatic minor upgrades are always applied. The master credential is created and held by RDS itself; only masterUserSecretArn is published, and each linked consumer gets its own PostgreSQL role.

Availability, durability and capacity defaults come from the environment type — a personal environment gets a single-AZ, no-reader, 1-day-retention sandbox profile; an organizational one gets a reader in a second zone, Multi-AZ and 14-day retention. The applied profile is published as the haProfile output field, and an explicit parameter always wins over it.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
mode	Which RDS shape to provision	aurora-serverless (default), provisioned-instance	No
version	PostgreSQL major version. RDS resolves it to the latest supported minor at create time.	16 (default)	No
instanceClass	Instance class for cluster members or the provisioned instance. Aurora Serverless v2 always uses db.serverless.	db.t4g.micro, db.t4g.medium	Conditional — default depends on the environment type
administratorLogin	Master username RDS creates	fractaladmin (default)	No
allocatedStorageGb	Initial storage. Provisioned mode only.	20 (default)	No
maxAllocatedStorageGb	Ceiling storage autoscaling grows to. Provisioned mode only.	100 (default)	No
minAcu	Aurora Serverless v2 capacity floor, in Aurora Capacity Units	0.5	Conditional — default depends on the environment type
maxAcu	Aurora Serverless v2 capacity ceiling, in Aurora Capacity Units	2, 8	Conditional — default depends on the environment type
readerCount	Aurora reader members. Aurora mode only, capped at 15 by AWS.	0, 1	Conditional — default depends on the environment type
multiAz	Provision a standby in a second zone. Provisioned mode only.	true, false	Conditional — default depends on the environment type
backupRetentionDays	Automated backup retention window	1, 14	Conditional — default depends on the environment type
deletionProtection	Refuse to delete the cluster or instance	false (default)	No
port	Listener port	5432 (default)	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.PostgreSqlDbms",
  "parameters": {
    "mode": "aurora-serverless",
    "version": "16",
    "administratorLogin": "fractaladmin",
    "minAcu": 0.5,
    "maxAcu": 8,
    "readerCount": 1,
    "backupRetentionDays": 14,
    "deletionProtection": true,
    "port": 5432
  }
}

Storage.PaaS.Rds

Legacy type name for Amazon RDS for PostgreSQL, kept so blueprints written before the rename keep reconciling. It routes to the same agent handler and reads the same parameters as Storage.PaaS.AwsRdsPostgres — prefer that name for new blueprints.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
mode	Which RDS shape to provision	aurora-serverless (default), provisioned-instance	No
version	PostgreSQL major version	16 (default)	No
instanceClass	Instance class for cluster members or the provisioned instance	db.t4g.micro, db.t4g.medium	Conditional — default depends on the environment type
administratorLogin	Master username RDS creates	fractaladmin (default)	No
allocatedStorageGb	Initial storage. Provisioned mode only.	20 (default)	No
maxAllocatedStorageGb	Ceiling storage autoscaling grows to. Provisioned mode only.	100 (default)	No
minAcu	Aurora Serverless v2 capacity floor	0.5	Conditional — default depends on the environment type
maxAcu	Aurora Serverless v2 capacity ceiling	2, 8	Conditional — default depends on the environment type
readerCount	Aurora reader members, capped at 15 by AWS	0, 1	Conditional — default depends on the environment type
multiAz	Provision a standby in a second zone. Provisioned mode only.	true, false	Conditional — default depends on the environment type
backupRetentionDays	Automated backup retention window	1, 14	Conditional — default depends on the environment type
deletionProtection	Refuse to delete the cluster or instance	false (default)	No
port	Listener port	5432 (default)	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.Rds",
  "parameters": {
    "mode": "provisioned-instance",
    "version": "16",
    "instanceClass": "db.t4g.medium",
    "allocatedStorageGb": 20,
    "maxAllocatedStorageGb": 100,
    "multiAz": true,
    "backupRetentionDays": 14,
    "deletionProtection": true,
    "port": 5432
  }
}

Storage.PaaS.S3

Amazon S3 object storage bucket for data persistence and archival.

Parameter	Description	Example / possible values	Required
region	AWS region the resource is created in. Blank → the environment region. Legacy alias: awsRegion.	us-east-1, eu-central-1	No
bucket	S3 bucket name (globally unique identifier)	my-data-bucket-12345	Yes
versioning	Enable object versioning	false	No
forceDestroy	Allow deletion of bucket with contents	false	No

Example (fully parameterized):

{
  "type": "Storage.PaaS.S3",
  "parameters": {
    "bucket": "my-data-bucket-12345",
    "versioning": false,
    "forceDestroy": false
  }
}

Storage.SaaS.Unmanaged

A placeholder for external or pre-existing storage systems not directly provisioned by Fractal Cloud.

Parameter	Description	Example / possible values	Required
secretName	Name of the secret storing credentials	storage-secret	No
secretValue	The secret value (credentials, connection string, etc.)	secret-content	Yes
secret	Reference to an environment secret holding the external service's credential, as {"$envSecret": "<shortName>"}. The raw value never travels in the blueprint.	{"$envSecret": "openai-api-key"}	Conditional — required when secretValue is not set

Example (fully parameterized):

{
  "type": "Storage.SaaS.Unmanaged",
  "parameters": {
    "secretName": "storage-secret",
    "secretValue": "secret-content"
  }
}