> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting started with the Terraform provider by Nebius AI Cloud

Nebius AI Cloud provides several interfaces to manage cloud resources. In addition to the [web console](https://console.nebius.com) and [CLI commands](/cli/index), you can use the Terraform provider by Nebius AI Cloud.

Terraform is most useful when you need to create and maintain multiple resources simultaneously. However, you can still create single resources by using Terraform.

The example below shows how to get started with the Terraform provider.

## Prepare your environment

### Install required tools

1. [Install Terraform](https://developer.hashicorp.com/terraform/install).

2. [Install jq](https://jqlang.github.io/jq/download/):

   <CodeGroup>
     ```bash Ubuntu theme={null}
     sudo apt-get install jq
     ```

     ```bash macOS theme={null}
     brew install jq
     ```
   </CodeGroup>

3. [Install](/cli/install) and [configure](/cli/configure) the Nebius AI Cloud CLI.

   The CLI and `jq` are only required for the example below.

### Configure access and credentials

In the example below, Terraform applies configurations on behalf of a Nebius AI Cloud [service account](/iam/overview#accounts-and-members). Alternatively, you can [authenticate with your user account](/terraform-provider/authentication#authenticating-with-your-user-account).

Make sure you are in a [group](/iam/authorization/groups/index) that has the `admin` role within your tenant or project; for example, the default `admins` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.

To configure access for the service account:

1. Create a service account and save its ID to an environment variable:

   ```bash theme={null}
   export SA_ID=$(nebius iam service-account create \
     --name terraform-sa --format json \
     | jq -r '.metadata.id')
   ```

2. Grant edit access to the service account:

   1. [Get the tenant ID](/iam/get-tenants).

   2. Get the ID of the default `editors` group:

      <Note>
        If you need to manage the Nebius AI Cloud resources by using the service account, use the `admins` group instead of `editors`. Specify `--name admins` in the command below.
      </Note>

      ```bash theme={null}
      export EDITORS_GROUP_ID=$(nebius iam group get-by-name \
        --name editors --parent-id <tenant_id> --format json \
        | jq -r '.metadata.id')
      ```

   3. Add the service account to the group:

      ```bash theme={null}
      nebius iam group-membership create \
        --parent-id $EDITORS_GROUP_ID \
        --member-id $SA_ID
      ```

3. Create an authorized key:

   1. Generate a key pair:

      ```bash theme={null}
      mkdir -p ~/.nebius/authkey
      export AUTHKEY_PRIVATE_PATH=~/.nebius/authkey/private.pem
      export AUTHKEY_PUBLIC_PATH=~/.nebius/authkey/public.pem
      openssl genrsa -out $AUTHKEY_PRIVATE_PATH 4096
      openssl rsa -in $AUTHKEY_PRIVATE_PATH \
        -outform PEM -pubout -out $AUTHKEY_PUBLIC_PATH
      ```

   2. Upload a public key to create the authorized key and save its ID to an environment variable:

      ```bash theme={null}
      export AUTHKEY_PUBLIC_ID=$(nebius iam auth-public-key create \
        --account-service-account-id $SA_ID \
        --data "$(cat $AUTHKEY_PUBLIC_PATH)" \
        --format json | jq -r '.metadata.id')
      ```

## Initialize a working directory

The configuration files for each infrastructure that you deploy with Terraform should be in their own working directory. This is where you will run the Terraform CLI commands.

Before creating configuration files that define cloud resources, initialize the working directory:

1. Create the working directory:

   ```bash theme={null}
   mkdir nebius-terraform-quickstart
   cd nebius-terraform-quickstart
   ```

2. Inside the directory, create files that contain settings related to Terraform and its providers:

   * `terraform.tf` lists the providers required for your configuration — in this case, the Nebius AI Cloud provider.

     ```hcl theme={null}
     terraform {
       required_providers {
         nebius = {
           source  = "nebius/nebius"
           version = ">= 0.6.8"
         }
       }
     }
     ```

   * `providers.tf` contains settings for the provider. `service_account` lists the environment variables that contain the credentials from the [previous section](#configure-access-and-credentials).

     ```hcl theme={null}
     provider "nebius" {
       service_account = {
         private_key_file_env = "AUTHKEY_PRIVATE_PATH"
         public_key_id_env    = "AUTHKEY_PUBLIC_ID"
         account_id_env       = "SA_ID"
       }
     }
     ```

     For more information, see [authentication in the provider](/terraform-provider/authentication).

3. Run the initialization command in the directory:

   ```bash theme={null}
   terraform init
   ```

## Create resources

After your working directory is initialized, define and build your infrastructure:

1. Inside the working directory, create configuration files. For example, create the following `main.tf` file that sets up a registry in the [Container Registry](/container-registry/index) service:

   ```hcl theme={null}
   resource "nebius_registry_v1_registry" "my-registry" {
     name        = "my-registry"
     parent_id   = "<project_ID>"
     description = "My registry"
   }
   ```

   `parent_id`: [Project ID](/iam/manage-projects#terraform-3).

2. Validate the configuration:

   ```bash theme={null}
   terraform validate
   ```

   If Terraform finds errors, the details are described in the output.

3. If the configuration is valid, apply it:

   ```bash theme={null}
   terraform apply
   ```

## See also

* [How to install the Terraform provider by Nebius AI Cloud](/terraform-provider/install)
* [Authentication in the Nebius AI Cloud provider for Terraform](/terraform-provider/authentication)

***

*InfiniBand and InfiniBand Trade Association are registered trademarks of the InfiniBand Trade Association.*