> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to install and initialize the Nebius AI Cloud provider for Terraform

Nebius AI Cloud provides several interfaces to manage cloud resources. In addition to the [web console](https://console.nebius.com) and [CLI commands](/cli/index), you can use the Terraform provider by Nebius AI Cloud.

Terraform is most useful when you need to create and maintain multiple resources simultaneously. However, you can still create single resources by using Terraform.

## Steps

### Install the required tools

1. [Install Terraform](https://developer.hashicorp.com/terraform/install):

   <CodeGroup>
     ```bash Ubuntu theme={null}
     wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
     echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(grep -oP '(?<=UBUNTU_CODENAME=).*' /etc/os-release || lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
     sudo apt update && sudo apt install terraform
     ```

     ```bash macOS theme={null}
     brew tap hashicorp/tap
     brew install hashicorp/tap/terraform
     ```
   </CodeGroup>

2. [Install jq](https://jqlang.github.io/jq/download/):

   <CodeGroup>
     ```bash Ubuntu theme={null}
     sudo apt-get install jq
     ```

     ```bash macOS theme={null}
     brew install jq
     ```
   </CodeGroup>

3. [Install and configure](/cli/install) the Nebius AI Cloud CLI.

### Configure access and credentials

In the example below, Terraform applies configurations on behalf of a Nebius AI Cloud [service account](/iam/overview#accounts-and-members). Alternatively, you can [authenticate with your user account](/terraform-provider/authentication#authentication-for-a-user-account).

Make sure you are in a [group](/iam/authorization/groups/index) that has the `admin` role within your tenant or project; for example, the default `admins` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.

To configure access for the service account:

1. Create a service account and save its ID to an environment variable:

   ```bash theme={null}
   export SA_ID=$(nebius iam service-account create \
     --name terraform-sa --format json \
     | jq -r '.metadata.id')
   ```

2. Grant edit access to the service account:

   1. [Get the tenant ID](/iam/get-tenants).

   2. Get the ID of the default `editors` group:

      <Note>
        If you need to manage the Nebius AI Cloud resources by using the service account, use the `admins` group instead of `editors`. Specify `--name admins` in the command below.
      </Note>

      ```bash theme={null}
      export EDITORS_GROUP_ID=$(nebius iam group get-by-name \
        --name editors --parent-id <tenant_id> --format json \
        | jq -r '.metadata.id')
      ```

   3. Add the service account to the group:

      ```bash theme={null}
      nebius iam group-membership create \
        --parent-id $EDITORS_GROUP_ID \
        --member-id $SA_ID
      ```

3. Create an authorized key:

   1. Generate a key pair:

      ```bash theme={null}
      mkdir -p ~/.nebius/authkey
      export AUTHKEY_PRIVATE_PATH=~/.nebius/authkey/private.pem
      export AUTHKEY_PUBLIC_PATH=~/.nebius/authkey/public.pem
      openssl genrsa -out $AUTHKEY_PRIVATE_PATH 4096
      openssl rsa -in $AUTHKEY_PRIVATE_PATH \
        -outform PEM -pubout -out $AUTHKEY_PUBLIC_PATH
      ```

   2. Upload a public key to create the authorized key and save its ID to an environment variable:

      ```bash theme={null}
      export AUTHKEY_PUBLIC_ID=$(nebius iam auth-public-key create \
        --account-service-account-id $SA_ID \
        --data "$(cat $AUTHKEY_PUBLIC_PATH)" \
        --format json | jq -r '.metadata.id')
      ```

### Initialize a working directory

The configuration files for each infrastructure that you deploy with Terraform should be in their own working directory. This is where you will run the Terraform CLI commands.

Before [creating configuration files](/terraform-provider/manage/create-resources) that define cloud resources, initialize the working directory:

1. Create the working directory:

   ```bash theme={null}
   mkdir nebius-terraform-quickstart
   cd nebius-terraform-quickstart
   ```

2. Inside the directory, create files that contain settings related to Terraform and its providers:

   * `terraform.tf` lists the providers required for your configuration — in this case, the Nebius AI Cloud provider.

     ```hcl theme={null}
     terraform {
       required_providers {
         nebius = {
           source  = "nebius/nebius"
           version = ">= 0.6.8"
         }
       }
     }
     ```

   * `providers.tf` contains settings for the provider. `service_account` lists the environment variables that contain the credentials from the [previous step](#configure-access-and-credentials).

     ```hcl theme={null}
     provider "nebius" {
       service_account = {
         private_key_file_env = "AUTHKEY_PRIVATE_PATH"
         public_key_id_env    = "AUTHKEY_PUBLIC_ID"
         account_id_env       = "SA_ID"
       }
     }
     ```

     <Note>
       If you authenticate with a user account, set `provider "nebius" {token = "<access_token>"}` in `providers.tf` instead of the configuration above. For more information, see [Authentication in the Nebius AI Cloud provider for Terraform](/terraform-provider/authentication).
     </Note>

3. Run the initialization command in the directory:

   ```bash theme={null}
   terraform init
   ```

## What’s next

* [Create resources](/terraform-provider/manage/create-resources) by using the Terraform provider.
* Learn how to [authenticate with a user account](/terraform-provider/authentication#authentication-for-a-user-account).
* If you had version 0.5.x of the provider, [migrate](/terraform-provider/manage/migrate) to the latest version with the Terraform Registry.