Provisions and manages Neo4j Aura instances via CLI (aura-cli v1.7+) or REST API. Use when creating, pausing, resuming, resizing, or deleting AuraDB Free/Professional/Business Critical/VDC instances; downloading credentials; scripting CI/CD pipelines; polling async status; or using the Terraform neo

When to Use Creating an Aura instance (CLI, REST API, Python, Terraform) Pausing, resuming, resizing, or deleting an instance Downloading initial credentials from creation response Polling instance status: creating → running Setting up CI/CD provisioning or teardown pipelines Choosing instance tier (Free vs Professional vs Business Critical vs VDC) When NOT to Use Cypher queries against running DB → neo4j cypher skill GDS algorithms on Aura → neo4j gds skill (Pro with plugin) or neo4j aura graph analytics skill (serverless) neo4j admin / cypher shell → neo4j cli tools skill Application driver setup → use a language driver skill (python, javascript, java, go, dotnet) Instance Tier Decision Table Tier API type code Memory GDS Replicas Use when AuraDB Free free db 1 GB ❌ ❌ Dev/demo; ≤200k nodes/400k rels AuraDB Professional professional db 2–64 GB plugin available ❌ Production workloads AuraDB Business Critical business critical 4–384 GB plugin available ✅ HA, multi AZ, SLA AuraDB VDC enterprise db custom ✅ ✅ Dedicated infra, compliance AuraDS Professional professional ds 2–64 GB ✅ built in ❌ Data science / GDS AuraDS Enterprise enterprise ds custom ✅ ✅ Enterprise GDS AuraDB Free limits : 200k nodes, 400k rels; auto pauses after 72 h inactivity; deleted if paused 30 days; no resize. Auth Setup CLI (aura cli v1.7+) Install (binary, not pip): Add credentials (from console.neo4j.io → Account Settings → API Credentials): Verify: REST API — Get Bearer Token Token endpoint: POST https://api.neo4j.io/oauth/token Token expires: 3600 s (1 h) . On 403 → refresh token. Use in all subsequent calls: header "Authorization: Bearer $TOKEN" Step 1 — List Tenants (Projects) CLI: REST: Step 2 — Create Instance CRITICAL: Capture output immediately. Initial password shown ONCE — never retrievable again. If lost: delete and recreate. Store aura creds.json before doing anything else. CLI REST API (full create) Instance create request body fields: Field Required Values name ✅ any string cloud provider ✅ gcp aws azure region ✅ see region table type ✅ see tier table tenant id ✅ from tenant list memory ✗ 1GB 2GB 4GB 8GB … 384GB version ✗ 5 (default) Step 3 — Poll Until RUNNING (CRITICAL — All Ops Are Async) ALL lifecycle operations (create, pause, resume, resize) are async. Do NOT attempt connection or next operation until status = running (or paused for pause op). REST equivalent: Status lifecycle: Step 4 — Write .env and Verify Step 5 — Lifecycle Operations All operations require instance in the correct state. Wrong state ops return 4xx error. Pause Required state: running Resume Required state: paused Resize (Professional+ only — NOT Free) Required state: running ; instance remains available during resize. Delete IRREVERSIBLE. Export snapshots first if data needed. REST: Python CI/CD Provisioning Script Region Codes AWS Region code Location us east 1 N. Virginia us east 2 Ohio us west 2 Oregon eu west 1 Ireland eu west 3 Paris eu central 1 Frankfurt ap southeast 1 Singapore ap southeast 2 Sydney ap south 1 Mumbai sa east 1 São Paulo GCP Region code Location europe west1 Belgium europe west3 Frankfurt europe west4 Netherlands us central1 Iowa us east1 S. Carolina us east4 N. Virginia asia east1 Taiwan asia northeast1 Tokyo asia southeast1 Singapore australia southeast1 Sydney Azure Region code Location eastus E. US eastus2 E. US 2 westeurope Netherlands northeurope Ireland uksouth London southeastasia Singapore brazilsouth Brazil koreacentral Korea Enterprise tiers (Business Critical, VDC) add 20+ additional regions per provider. Check console for full list. Free tier: GCP only; limited subset of regions. Terraform Provider After terraform apply : poll status before marking infra ready — Terraform resource creation returns when API call completes, not when DB is running . Common Errors Error Cause Fix 403 Forbidden after working Token expired (1 h TTL) Re run get token() 409 Conflict on create Name already exists in tenant Change name or delete existing 422 on pause Instance not running Check status; wait for ongoing op to finish 422 on resume Instance not paused Check status 422 on resize Below current usage Reduce data first; can't shrink below usage Region not found Tier doesn't support that region Use Free tier on GCP only; Pro/BC on all 3 clouds Credentials lost after create Password only returned at create time Delete + recreate — no reset exists 429 Too Many Requests Rate limit hit (25 req/min Free, 125 req/min Pro+) Add time.sleep(2) between polling calls instance list returns empty Wrong credential active aura cli credential use name <name API Rate Limits Tier Requests/minute Free / Pro Trial (no billing) 25 Pro with billing, BC, VDC 125 Poll interval: ≥10 s to stay within limits on Free; 5 s safe on Pro+. On Retry After header in 5xx response: wait that many seconds before retry. Security Rules Write initial credentials to .env ; verify .env in .gitignore before proceeding Never print PASSWORD in CI logs — write to secrets vault (AWS Secrets Manager, GitHub secret, Vault) Use from env() / os.environ — never hardcode credentials If .env absent: python dotenv load dotenv() auto loads; do NOT prompt user unless loading fails WebFetch — Current Docs Need URL REST API spec (OpenAPI) https://neo4j.com/docs/aura/platform/api/specification/ CLI reference https://neo4j.com/docs/aura/aura cli/ Region list https://neo4j.com/docs/aura/managing instances/regions/ Auth details https://neo4j.com/docs/aura/api/authentication/ Instance actions https://neo4j.com/docs/aura/managing instances/instance actions/ Checklist [ ] .env created with URI/user/password; .env in .gitignore [ ] Initial credentials saved to secure storage immediately after create [ ] poll status called after create — do NOT connect before status = running [ ] poll status called after pause/resume [ ] Correct tier selected (Free for dev, Pro+ for production, BC for HA) [ ] Region confirmed available for chosen tier and cloud provider [ ] Tenant ID provided for all create/list operations (required in multi tenant orgs) [ ] Token refreshed if 1 h old (or 403 received) [ ] Delete confirmed by user — data loss is permanent, no recovery

neo4j-aura-provisioning-skill