How to install and initialize the Nebius AI Cloud provider for Terraform

​

Steps

​

Install the required tools

1. Install Terraform:
   Ubuntu

   macOS

   wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
   echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(grep -oP '(?<=UBUNTU_CODENAME=).*' /etc/os-release || lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
   sudo apt update && sudo apt install terraform
   
2. Install jq:
   Ubuntu

   macOS

   sudo apt-get install jq
   
3. Install and configure the Nebius AI Cloud CLI.

​

Configure access and credentials

1. Create a service account and save its ID to an environment variable:
   export SA_ID=$(nebius iam service-account create \
     --name terraform-sa --format json \
     | jq -r '.metadata.id')
   
2. Grant edit access to the service account:
   1. Get the tenant ID.
   2. Get the ID of the default editors group:
      If you need to manage the Nebius AI Cloud resources by using the service account, use the admins group instead of editors. Specify --name admins in the command below.
      export EDITORS_GROUP_ID=$(nebius iam group get-by-name \
        --name editors --parent-id <tenant_id> --format json \
        | jq -r '.metadata.id')
      
   3. Add the service account to the group:
      nebius iam group-membership create \
        --parent-id $EDITORS_GROUP_ID \
        --member-id $SA_ID
      
3. Create an authorized key:
   1. Generate a key pair:
      mkdir -p ~/.nebius/authkey
      export AUTHKEY_PRIVATE_PATH=~/.nebius/authkey/private.pem
      export AUTHKEY_PUBLIC_PATH=~/.nebius/authkey/public.pem
      openssl genrsa -out $AUTHKEY_PRIVATE_PATH 4096
      openssl rsa -in $AUTHKEY_PRIVATE_PATH \
        -outform PEM -pubout -out $AUTHKEY_PUBLIC_PATH
      
   2. Upload a public key to create the authorized key and save its ID to an environment variable:
      export AUTHKEY_PUBLIC_ID=$(nebius iam auth-public-key create \
        --account-service-account-id $SA_ID \
        --data "$(cat $AUTHKEY_PUBLIC_PATH)" \
        --format json | jq -r '.metadata.id')
      

​

Initialize a working directory

1. Create the working directory:
   mkdir nebius-terraform-quickstart
   cd nebius-terraform-quickstart
   
2. Inside the directory, create files that contain settings related to Terraform and its providers:
   • terraform.tf lists the providers required for your configuration — in this case, the Nebius AI Cloud provider.
     terraform {
       required_providers {
         nebius = {
           source  = "nebius/nebius"
           version = ">= 0.6.8"
         }
       }
     }
     
   • providers.tf contains settings for the provider. service_account lists the environment variables that contain the credentials from the previous step.
     provider "nebius" {
       service_account = {
         private_key_file_env = "AUTHKEY_PRIVATE_PATH"
         public_key_id_env    = "AUTHKEY_PUBLIC_ID"
         account_id_env       = "SA_ID"
       }
     }
     
     If you authenticate with a user account, set provider "nebius" {token = "<access_token>"} in providers.tf instead of the configuration above. For more information, see Authentication in the Nebius AI Cloud provider for Terraform.
3. Run the initialization command in the directory:
   terraform init
   

​

What’s next

• Create resources by using the Terraform provider.
• Learn how to authenticate with a user account.
• If you had version 0.5.x of the provider, migrate to the latest version with the Terraform Registry.