Kyku supports four cloud providers with a unified resource API. Each provider supports a subset of resource types. Unsupported resources throw UnsupportedFeatureError at validation time.
| Resource |
AWS |
GCP |
Hetzner |
DigitalOcean |
| Vpc |
✅ EC2-VPC |
✅ VPC Network |
✅ Network |
✅ VPC |
| Subnet |
✅ EC2-VPC |
✅ (synthetic) |
✅ (synthetic) |
✅ (synthetic) |
| Vm |
✅ EC2 |
✅ Compute Engine |
✅ Cloud Server |
✅ Droplet |
| SecurityGroup |
✅ EC2-SG |
✅ Firewall Rules |
✅ Firewall |
✅ Cloud Firewall |
| LoadBalancer |
✅ ALB/NLB |
✅ LB stack |
✅ LB |
✅ LB |
| TargetGroup |
✅ TG |
❌ |
✅ TG |
✅ TG |
| Database |
✅ RDS |
✅ Cloud SQL |
❌ |
✅ Managed DB |
| Identity |
✅ IAM User |
✅ Service Account |
❌ |
❌ |
| Role |
✅ IAM Role |
✅ Custom Role |
❌ |
❌ |
| SshKey |
✅ Key Pair |
❌ |
✅ SSH Key |
✅ SSH Key |
| Bucket |
✅ S3 |
✅ Cloud Storage |
✅ S3-compat |
✅ Spaces S3 |
| DnsZone |
✅ Route53 |
✅ Cloud DNS |
✅ DNS API |
✅ Domain |
| DnsRecord |
✅ Route53 |
✅ Cloud DNS |
✅ DNS API |
✅ Record |
| Custom |
✅ wired |
✅ wired |
✅ wired |
✅ wired |
| Provider |
Env vars |
Source |
| AWS |
AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY |
IAM user or OIDC |
| GCP |
GOOGLE_PROJECT_ID, GOOGLE_APPLICATION_CREDENTIALS |
Service account key or ADC |
| Hetzner |
HCLOUD_TOKEN |
Cloud Console → API Tokens |
| Hetzner DNS |
HETZNER_DNS_TOKEN |
DNS Console → API Tokens |
| Hetzner S3 |
HETZNER_S3_REGION, HETZNER_S3_ACCESS_KEY, HETZNER_S3_SECRET_KEY |
Console → Security → S3 Credentials |
| DigitalOcean |
DIGITALOCEAN_TOKEN |
API → Tokens |
| DO Spaces |
DO_SPACES_REGION, DO_SPACES_ACCESS_KEY, DO_SPACES_SECRET_KEY |
API → Spaces |
- GCP TargetGroup: Not supported — use managed instance groups instead.
- GCP SshKey: Not supported — use
sshPublicKey field directly on Vm.
- Hetzner Database/Identity/Role: Not available in Hetzner Cloud API.
- DO Identity/Role: Not available in DigitalOcean API.
- Subnet: Synthetic resource — auto-injected by the planner; no standalone cloud resource.
- Bucket (Hetzner S3 & DO Spaces): Uses
@aws-sdk/client-s3 with endpoint override + SigV4 auth.
| Strategy |
AWS |
GCP |
Hetzner |
DO |
| Env vars |
✅ |
✅ |
✅ |
✅ |
| OIDC (CI) |
✅ STS AssumeRoleWithWebIdentity |
✅ Workload Identity Federation |
❌ |
❌ |
| SSO |
✅ aws sso login |
✅ gcloud auth |
❌ |
❌ |
| Token file |
❌ |
✅ ADC file |
✅ HCLOUD_TOKEN |
✅ DIGITALOCEAN_TOKEN |
