> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Nebius AI Cloud provider for Terraform configuration arguments

To configure settings for the Nebius AI Cloud provider for Terraform, use the `provider "nebius"` block in the configuration. For example:

```terraform theme={null}
provider "nebius" {
  profile = {
    // will use profile with this name from Nebius CLI config
    name = "your-service-account-profile"
    // we recommend using Service Accounts for Terraform authentication
  }
}
```

## Schema

### Optional

* `address_options` (Attributes Map) Set specific options for each address. Use "\*" to set them for all addresses at once. Empty options will result in default TLS connection for this address, thus overriding "\*". (see [below for nested schema](#nestedatt--address_options))
* `address_template` (Attributes) address template (overrides address\_template\_env) (see [below for nested schema](#nestedatt--address_template))
* `address_template_env` (String) env variable name to obtain address template in form of `FIND=REPLACE`
* `auth_timeout` (String) timeout for each Nebius SDK request including authentication, default 15m0s, as a string: possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as `300ms`, `-1.5h` or `2h45m`. Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`, `d`
* `domain` (String) custom domain name (overrides domain\_env)
* `domain_env` (String) env variable name to obtain custom domain name
* `impersonate_service_account_id` (String) Service account ID to impersonate.
* `module_name` (String) it is suggested to set this value to your module name if the provider is initialized in one, does not affect any behaviors
* `no_credentials` (Boolean) do not authenticate
* `parent_id` (String) Parent ID if it is not read from the profile, or if you want to overwrite it.
* `per_retry_timeout` (String) timeout for each Nebius SDK request retry, default 20s, as a string: possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as `300ms`, `-1.5h` or `2h45m`. Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`, `d`
* `profile` (Attributes) Reads profile from the CLI config. (see [below for nested schema](#nestedatt--profile))
* `resolvers` (Map of String) resolver map of type `[pattern|service_id]->address`
* `resolvers_env` (String) env variable name that holds resolver map (may be set alongside resolvers)
* `retries` (Number) number of retries for each Nebius SDK request, default 3
* `service_account` (Attributes) sets service account credentials (is overridden by token) (see [below for nested schema](#nestedatt--service_account))
* `timeout` (String) timeout for each Nebius SDK request, default 1m0s, as a string: possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as `300ms`, `-1.5h` or `2h45m`. Valid time units are `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`, `d`
* `token` (String) authenticate using this IAM token
* `versioned_ephemeral_values` (Dynamic, Sensitive) A map of all ephemeral values that will be passed to nebius\_hash for hashing

<a id="nestedatt--address_options" />

### Nested Schema for `address_options`

Optional:

* `insecure` (Boolean) use plain http connection
* `no_tls_verify` (Boolean) don't verify TLS certificates

<a id="nestedatt--address_template" />

### Nested Schema for `address_template`

Required:

* `find` (String)
* `replace` (String)

<a id="nestedatt--profile" />

### Nested Schema for `profile`

Optional:

* `cache_file` (String) File path to cache the token in, defaults to `~/.nebius//credentials.yaml`
* `client_id` (String) Client ID for federation authentication, defaults to `terraform-provider`
* `config_file` (String) File path to cache the token in, defaults to `~/.nebius//config.yaml`
* `name` (String) Profile name to use, uses the default profile if not set.
* `no_browser_open` (Boolean) If set to true, the provider will not open a browser window for federation authentication, only showing the URL through the logger.

<a id="nestedatt--service_account" />

### Nested Schema for `service_account`

Optional:

* `account_id` (String) service account ID (overrides account\_id\_env)
* `account_id_env` (String) env var containing service account ID
* `credentials_file` (String) file path of the service account credentials file (overrides credentials\_file\_env)
  You can set this file instead of other parameters here, it will silently override them.
* `credentials_file_env` (String) env var containing file path of the service account credentials, same as credentials\_file
* `private_key` (String) private key (overrides private\_key\_file and private\_key\_file\_env)
* `private_key_file` (String) file path of the service account private key (overrides private\_key\_file\_env)
* `private_key_file_env` (String) env var containing file path of the service account private key
* `public_key_id` (String) service account public key ID (overrides public\_key\_id\_env)
* `public_key_id_env` (String) env var containing service account public key ID