Live today · four clouds

One canvas forHetznerGoogle CloudAWSAzure

Real credentials, real API calls, real resources. The same nodes, the same edges and the same plan describe all four, because every provider speaks through one strategy rather than its own bespoke screen.

Start free↗Support matrix

Pick a cloud.
Read the whole truth about it.

Hetzner

Cloud servers, private networks, floating IPs.

Credential
A project API token, read & writeValidated the moment you save it with a read-only call, so a token with the wrong scope fails at the connection screen rather than halfway through an apply.
Worth knowing
A server type carries its own disk here, so a rescale happens powered off and growing the disk can never be undone. CrossXCloud says so before you apply, not after.
On the canvas
  • fsn1Falkenstein, DE
  • nbg1Nuremberg, DE
  • hel1Helsinki, FI
  • ashAshburn, VA

Google Cloud

Compute Engine instances, VPC networks and subnets, firewall rules, static external addresses.

Credential
A service account key, pasted as JSONThe project ID is read out of the key itself, so there is nothing to type twice and nothing to get wrong.
Worth knowing
Enable the Compute Engine API and give the account Compute Admin — or, if you would rather keep it narrow, the instance, network and security admin roles it actually uses.
On the canvas
  • us-central1Council Bluffs, IA
  • europe-west3Frankfurt, DE
  • asia-northeast1Tokyo, JP
  • australia-southeast1Sydney, AU
  • southamerica-east1São Paulo, BR

AWS

EC2 instances, VPC networking, elastic IP addresses.

Credential
Access keys, an assumed role, or a named profileStatic keys, an STS assume-role on top of them, or a profile from your shared AWS config. The region travels with the credential, so one connection is one account in one region and never quietly spans two.
Worth knowing
Sessions and assumed roles expire. Test a connection and CrossXCloud asks STS whether yours is still alive, so the answer arrives while you are looking at it rather than mid-apply.
On the canvas
  • us-east-1N. Virginia
  • eu-west-1Ireland
  • ap-southeast-1Singapore

Azure

Virtual Machines, VNet networking, public IPs, inside a resource group.

Credential
An app registration, plus a subscription IDTenant ID, client ID and client secret. The subscription is required because every Azure Resource Manager call is scoped to one.
Worth knowing
An app-registration secret dies on a date Entra fixed when it was created. CrossXCloud requests a token the moment you connect, so an expired secret is named there rather than months later, opaquely, mid-apply.
On the canvas
  • westeuropeNetherlands
  • eastusVirginia

The whole matrix.
No asterisks.

Capability support by cloud provider
CapabilityHetznerGoogle CloudAWSAzure
ComputeLiveLiveLiveLive
Private networksLiveLiveLiveLive
Floating IPsLiveLiveLiveLive
Catalog read from the provider APILiveLiveLiveLive
What is not here

Managed VPC-as-a-node and serverless exist in the codebase as interfaces with nothing behind them. They are not on this page, not in the docs and not in the node palette, because a stub is not a feature. When they ship, this table changes first.

Four clouds.
Zero keys of yours, here.

Every credential above is sealed in a passphrase vault on your own disk. It is decrypted in memory only while that vault is unlocked, and never sent to us, to CrossXWeb, or to anyone else. The canvas talks to your cloud directly, with your key, from your machine.

  1. 01SaveThe credential is encrypted with the vault public key and written to the keystore as a sealed blob.
  2. 02UsePlan and Apply decrypt it in memory. The plaintext is never written to disk.
  3. 03LockThe private key is cleared. The blob stays on disk and is useless until the next unlock.

The same applies to a credential that has died: an expired AWS session or an Entra secret past its date is reported when you connect or test it, not discovered halfway through changing your infrastructure. How the vault works →

Connect one. Or all four.

Drawing, diffing and planning are free on every provider. A credit is spent only when an apply step touches your cloud.

Start free↗Connect a provider