> ## Documentation Index > Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt > Use this file to discover all available pages before exploring further. # EC2 Control Plane > EC2 Control Plane APIs with Cloud Adapter. This page describes how EC2 Control Plane maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior. ## Supported environments * Azure * Google Cloud * Scaleway Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available. ## How the targets compare Each row compares a capability of EC2 Control Plane with its adaptation on each target. A dash means this profile does not state the capability for that target. ### Cloud Adapter | Capability | EC2 Control Plane | Azure | Google Cloud | Scaleway | | ------------------------------------------------------------------------------------ | ----------------------------------------------- | -------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | | Launch request shape · what RunInstances accepts | the full RunInstances request | image, type, counts, one subnet or interface, groups, zone, user data, instance tags, client token | image, type, counts, one subnet or interface, groups, zone, user data, instance tags, client token | - | | Launch readiness · accept, then reconcile | `pending`, then `running` as EC2 reports it | ids at once; `pending` until Azure reports the virtual machine's power state | ids at once; `pending` until Compute Engine reports the instance running | - | | Zone placement | Placement.AvailabilityZone | regional; a zone request needs an acknowledgement | a zone of the deployment's region | - | | Security-group changes · ModifyInstanceAttribute groupSet | the instance's security groups | the application security groups on the virtual machine's network interface | the network tags on the instance | - | | Instance tags | EC2 tags, visible on the console and in billing | held on the instance record | held on the instance record | - | | Discovery scope | every instance in the account | instances this control plane launched or registered | instances this control plane launched or registered | - | | Termination | `shutting-down`, then `terminated` | VM deleted, then its interface; `terminated` answered for an hour | instance deleted; `terminated` answered for an hour | - | | API coverage | full | partial | partial | minimal | | Self-discovery is served; fleet management is not · the distinction that decides fit | the full EC2 management API | - | - | ec2:Describe\* about this instance, and nothing else | | Scaleway has no declared EC2 management backend · where four sibling clouds do | EC2 managing EC2 | - | - | nothing declared | | This origin and your instances resolve together · they cannot split across clouds | ec2::control and ec2::instance | - | - | both on Scaleway, always | ## On Azure ### Virtual Machines | Operation | Area | Support | Depth | Notes | | ----------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | ModifyInstanceAttribute / DescribeInstanceAttribute | Attributes | Partial | Most usage | ModifyInstanceAttribute changes the security groups (groupSet) of a live instance this control plane launched, and the change reconciles onto the application security groups on the virtual machine's network interface; every other attribute is refused. DescribeInstanceAttribute answers instanceType, groupSet, userData, rootDeviceName, sourceDestCheck and the boolean attributes from the record. | | DescribeInstanceTypes / DescribeVolumes | Catalogue | Partial | Full surface | DescribeInstanceTypes answers explicit InstanceType values from the machine catalog; DescribeVolumes lists the root volume of each instance this control plane launched, by VolumeId or in full. Neither takes filters or pagination. | | Images, status, fleets and the rest of the EC2 control plane | Catalogue | Out of scope | Full surface | DescribeImages, DescribeInstanceStatus, Spot and fleet requests, launch templates, capacity reservations, key pairs, AMI and snapshot management and placement groups are refused with an error naming the operation; nothing is created or reported in their place. An image is resolved at RunInstances through ImageId, and there is no image registry to query. | | DescribeInstances | Discovery | Partial | Common | Lists the instances this control plane holds a record for, by InstanceId or with filters (instance-id, instance-state-name, instance-type, image-id, availability-zone, subnet-id, vpc-id, private-ip-address, the group-id and group-name filters, architecture, root-device-type, virtualization-type and the tag filters); another filter name is refused. MaxResults takes 5 to 1000 with a NextToken and, as on EC2, cannot be combined with InstanceId. State, private address and launch time are read from the Azure virtual machine on every call: a fresh launch reads `pending` until Azure reports the virtual machine's power state, and a change made on the Azure side shows on the next call. Other virtual machines in the subscription are not listed. | | Self-discovery (the calling instance's own DescribeInstances, DescribeVpcs, DescribeSubnets, DescribeSecurityGroups, DescribeAvailabilityZones) | Discovery | Supported | Common | Answered for the calling instance from the same identity the instance-metadata service serves, so code that learns its own instance, VPC, subnet and security groups two ways sees one picture. The metadata surface is on the EC2 card for Azure Virtual Machines; the network describes are on the VPC card for Azure Virtual Network. | | RunInstances | Launch | Partial | Common | Creates one network interface and one virtual machine in the resource group and region the deployment runs in, one per requested instance, and returns the instance ids at once. The request may name ImageId, InstanceType, MinCount and MaxCount, a SubnetId with an optional PrivateIpAddress and SecurityGroupIds (or one primary NetworkInterface carrying the same three, inline or naming an interface created with CreateNetworkInterface), Placement.AvailabilityZone, UserData, instance TagSpecifications, a ClientToken and DryRun. Any other member present, including BlockDeviceMappings, KeyName, IamInstanceProfile, a LaunchTemplate, a second network interface, a public address at launch, detailed monitoring, hibernation, termination protection or EbsOptimized, is refused with an error naming it; nothing launches with the member dropped. A Placement.AvailabilityZone is refused unless the deployment acknowledges regional placement, because the virtual machine is placed regionally and a zone the reconciler cannot honour would otherwise be dropped silently. The instance type is resolved to a machine size when the request is accepted and recorded with the instance, so a later catalog change does not move a running instance. Which sizes and images a launch resolves to is on the EC2 card for Azure Virtual Machines. | | StopInstances / StartInstances / RebootInstances | Lifecycle | Out of scope | Common | Refused with an error, and the Azure virtual machine is left as it is. Stop, start or restart the machine through Azure's own controls, or terminate and relaunch it through this API. | | TerminateInstances | Lifecycle | Supported | Common | Withdraws each named instance; on Azure the virtual machine is deleted and then its network interface. The instance reads `shutting-down` while Azure still holds the machine and `terminated` once it does not, and a DescribeInstances that names the id keeps answering `terminated` for an hour after teardown, which is the state an SDK delete waiter polls for. Force and SkipOsShutdown are refused. An instance registered by another owner is refused; it is never deleted from under that owner. | | CreateTags / DeleteTags / DescribeTags (instances) | Tags | Partial | Most usage | Tags on an instance are held on its record and answered by DescribeTags, DescribeInstances and the tag filters. They are not written to the Azure virtual machine as Azure resource tags, so a report, policy or console filter on the Azure side does not see them. | #### Request recording and reconciliation on Azure A RunInstances call is checked against the launch shape, given instance ids and recorded. The reconciler then creates a network interface in the subnet the request named, with the private address it asked for and the application security groups its security groups resolve to, and a virtual machine of the size the instance type resolved to, in the deployment's resource group and region. DescribeInstances reads the virtual machine's power state, private address and launch time from Azure on every call, so a launch reads `pending` until Azure's instance view reports the machine, and a change made in the Azure portal shows on the next describe. TerminateInstances withdraws the record and deletes the virtual machine, then its network interface. The instance reads `shutting-down` while Azure still holds the machine and `terminated` once it does not, and stays answerable by id for an hour so a delete waiter completes. A ClientToken makes a retried launch return the instances already minted for it, and a replay cannot bring back a batch that was terminated. #### Placement, tags and identity on Azure Azure places the virtual machine regionally. A request that names a Placement.AvailabilityZone is refused until the deployment acknowledges regional placement; the refusal names the acknowledgement. Instance ids are EC2-shaped (`i-…`) and stable for the life of the instance. The virtual machine carries the adapter's own provenance tags; your EC2 tags stay on the instance record, where DescribeTags and the tag filters answer them, and do not appear on the Azure resource. Security-group membership lives on the network interface as application security groups, so a ModifyInstanceAttribute groupSet change reconciles onto the interface and the NSG rules described on the VPC card for Azure Virtual Network take effect. #### Limitations * **Stop, start and reboot are refused.** StopInstances, StartInstances and RebootInstances answer an error and leave the virtual machine as it is; use Azure's own power controls, or terminate and relaunch. - **The launch shape is bounded.** BlockDeviceMappings, KeyName, IamInstanceProfile, LaunchTemplate, a second network interface, a public address at launch, detailed monitoring, hibernation, termination protection and EbsOptimized are refused with an error naming the member, and the request has to be rewritten without it. - **A zone request needs an acknowledgement.** A Placement.AvailabilityZone is refused until the deployment acknowledges regional placement. - **Tags stay on the record.** EC2 tags are not written to the virtual machine's Azure resource tags, so an Azure policy, cost report or console filter keyed on them sees nothing. - **Discovery is scoped to this control plane's records.** DescribeInstances lists the instances it launched or registered; other virtual machines in the subscription, images, instance status and fleets are not answered, and a filter outside the listed set is refused. - **Readiness is observed.** An accepted launch is not a running machine; DescribeInstances reads `pending` until Azure reports the virtual machine. #### Other considerations * **Operation.** Microsoft operates the virtual machines, interfaces and disks, which bill as Azure resources; Tensor9 operates the adapter that records and reconciles requests. - **Identity.** Instance ids are EC2-shaped and stable for the instance's life, and a ClientToken is honoured so a retried launch does not double a batch. - **Termination window.** A terminated instance stays answerable by id for an hour, so waiters and cleanup scripts that poll for `terminated` complete; after that the id answers InvalidInstanceID.NotFound. ## On Google Cloud ### Compute Engine | Operation | Area | Support | Depth | Notes | | ----------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ModifyInstanceAttribute / DescribeInstanceAttribute | Attributes | Partial | Most usage | ModifyInstanceAttribute changes the security groups (groupSet) of a live instance this control plane launched, and the change reconciles onto the network tags on the instance; every other attribute is refused. DescribeInstanceAttribute answers instanceType, groupSet, userData, rootDeviceName, sourceDestCheck and the boolean attributes from the record. | | DescribeInstanceTypes / DescribeVolumes | Catalogue | Partial | Full surface | DescribeInstanceTypes answers explicit InstanceType values from the machine catalog; DescribeVolumes lists the root volume of each instance this control plane launched, by VolumeId or in full. Neither takes filters or pagination. | | Images, status, fleets and the rest of the EC2 control plane | Catalogue | Out of scope | Full surface | DescribeImages, DescribeInstanceStatus, Spot and fleet requests, launch templates, capacity reservations, key pairs, AMI and snapshot management and placement groups are refused with an error naming the operation; nothing is created or reported in their place. An image is resolved at RunInstances through ImageId, and there is no image registry to query. | | DescribeInstances | Discovery | Partial | Common | Lists the instances this control plane holds a record for, by InstanceId or with filters (instance-id, instance-state-name, instance-type, image-id, availability-zone, subnet-id, vpc-id, private-ip-address, the group-id and group-name filters, architecture, root-device-type, virtualization-type and the tag filters); another filter name is refused. MaxResults takes 5 to 1000 with a NextToken and, as on EC2, cannot be combined with InstanceId. State, private address and launch time are read from the Compute Engine instance on every call: a fresh launch reads `pending` until Compute Engine reports the instance running, and a change made on the Google Cloud side shows on the next call. Other instances in the project are not listed. | | Self-discovery (the calling instance's own DescribeInstances, DescribeVpcs, DescribeSubnets, DescribeSecurityGroups, DescribeAvailabilityZones) | Discovery | Supported | Common | Answered for the calling instance from the same identity the instance-metadata service serves, so code that learns its own instance, VPC, subnet and security groups two ways sees one picture. The metadata surface is on the EC2 card for Google Compute Engine; the network describes are on the VPC card for Google Cloud VPC. | | RunInstances | Launch | Partial | Common | Creates one Compute Engine instance in a zone of the deployment's region, one per requested instance, and returns the instance ids at once. The request may name ImageId, InstanceType, MinCount and MaxCount, a SubnetId with an optional PrivateIpAddress and SecurityGroupIds (or one primary NetworkInterface carrying the same three, inline or naming an interface created with CreateNetworkInterface), Placement.AvailabilityZone, UserData, instance TagSpecifications, a ClientToken and DryRun. Any other member present, including BlockDeviceMappings, KeyName, IamInstanceProfile, a LaunchTemplate, a second network interface, a public address at launch, detailed monitoring, hibernation, termination protection or EbsOptimized, is refused with an error naming it; nothing launches with the member dropped. A Placement.AvailabilityZone is mapped onto a zone of the deployment's region, so the instance is zonal, as on EC2. The instance type is resolved to a machine size when the request is accepted and recorded with the instance, so a later catalog change does not move a running instance. Which sizes and images a launch resolves to is on the EC2 card for Google Compute Engine. | | StopInstances / StartInstances / RebootInstances | Lifecycle | Out of scope | Common | Refused with an error, and the Compute Engine instance is left as it is. Stop, start or restart the machine through Google Cloud's own controls, or terminate and relaunch it through this API. | | TerminateInstances | Lifecycle | Supported | Common | Withdraws each named instance; on Google Cloud the instance is deleted through the same path that created it. The instance reads `shutting-down` while Google Cloud still holds the machine and `terminated` once it does not, and a DescribeInstances that names the id keeps answering `terminated` for an hour after teardown, which is the state an SDK delete waiter polls for. Force and SkipOsShutdown are refused. An instance registered by another owner is refused; it is never deleted from under that owner. An instance that belongs to an Auto Scaling group is removed through its managed instance group, never deleted underneath the group. | | CreateTags / DeleteTags / DescribeTags (instances) | Tags | Partial | Most usage | Tags on an instance are held on its record and answered by DescribeTags, DescribeInstances and the tag filters. They are not written to the Compute Engine instance as Compute Engine labels, so a report, policy or console filter on the Google Cloud side does not see them. | #### Request recording and reconciliation on Compute Engine A RunInstances call is checked against the launch shape, given instance ids and recorded. The reconciler then creates one Compute Engine instance per requested instance in a zone of the deployment's region, in the subnetwork the request named, with the private address it asked for, the network tags its security groups resolve to, and the machine type the instance type resolved to; the boot disk type is chosen to suit that machine family (Hyperdisk Balanced on N4, for example). DescribeInstances reads the instance's status, private address and creation time from Compute Engine on every call, so a launch reads `pending` until the instance is running, and a change made in the Google Cloud console shows on the next describe. TerminateInstances withdraws the record and deletes the instance. It reads `shutting-down` while Compute Engine still holds the machine and `terminated` once it does not, and stays answerable by id for an hour so a delete waiter completes. A member of an Auto Scaling group is removed through its managed instance group. A ClientToken makes a retried launch return the instances already minted for it, and a replay cannot bring back a batch that was terminated. #### Placement, tags and identity on Compute Engine The availability zone a request names is mapped onto a zone of the deployment's region, so zonal placement carries. Instance ids are EC2-shaped (`i-…`) and stable for the life of the instance. Your EC2 tags stay on the instance record, where DescribeTags and the tag filters answer them; they are not written as Compute Engine labels, so a label-based billing export or console filter does not see them. Security-group membership is expressed as network tags on the instance, so a ModifyInstanceAttribute groupSet change reconciles onto the instance's tags and the firewall rules described on the VPC card for Google Cloud VPC take effect. #### Limitations * **Stop, start and reboot are refused.** StopInstances, StartInstances and RebootInstances answer an error and leave the instance as it is; use Compute Engine's own controls, or terminate and relaunch. - **The launch shape is bounded.** BlockDeviceMappings, KeyName, IamInstanceProfile, LaunchTemplate, a second network interface, a public address at launch, detailed monitoring, hibernation, termination protection and EbsOptimized are refused with an error naming the member, and the request has to be rewritten without it. - **Tags stay on the record.** EC2 tags are not written as Compute Engine labels, so a label-keyed billing export, policy or console filter sees nothing. - **Discovery is scoped to this control plane's records.** DescribeInstances lists the instances it launched or registered; other instances in the project, images, instance status and fleets are not answered, and a filter outside the listed set is refused. - **Readiness is observed.** An accepted launch is not a running machine; DescribeInstances reads `pending` until Compute Engine reports the instance running. #### Other considerations * **Operation.** Google operates the instances, their interfaces and disks, which bill as Compute Engine resources; Tensor9 operates the adapter that records and reconciles requests. - **Identity.** Instance ids are EC2-shaped and stable for the instance's life, and a ClientToken is honoured so a retried launch does not double a batch. - **Termination window.** A terminated instance stays answerable by id for an hour, so waiters and cleanup scripts that poll for `terminated` complete; after that the id answers InvalidInstanceID.NotFound. ## On Scaleway ### Scaleway Instance | Operation | Area | Support | Depth | Notes | | ------------------------------------------------- | -------------------- | -------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DescribeImages / DescribeInstanceTypes / tags | Catalogue & metadata | Out of scope | Most usage | not served | | DescribeInstances (other instances / fleets) | Fleet management | Out of scope | Common | a query that is not about the caller's own instance is not served - see the card | | RunInstances / TerminateInstances / StopInstances | Fleet management | Out of scope | Common | creating, stopping or terminating instances through the EC2 API is not served on Scaleway; instances are created by the compiled Terraform, not at runtime | | DescribeInstances (this instance) | Self-discovery | Adapter-served | Common | answered for the POD'S OWN instance from the same emulation identity the instance-metadata service serves, so the two can never disagree about what this workload is | ## Existing data and credentials Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target. ## Configure, tune and debug Start with [setup](/cloud-adapter/getting-started/overview) and [configuration](/cloud-adapter/configuration/overview). Use [tuning](/cloud-adapter/tuning/overview) to understand supported request tags, [debugging](/cloud-adapter/debugging/overview) to investigate a request, and [High Fidelity Cloud Emulators](/cloud-adapter/local-testing/overview) to validate a bounded reproduction. For requests that go through the service adapter, use [tensor9 explain](/cloud-adapter/debugging/explain) and [x-t9-explain](/cloud-adapter/debugging/response-headers) to inspect the selected mapping.