Provider Reference

Reference for the qumulo provider block: cloud deployment blocks, cluster connection profiles, and Nexus integration.

Deploying a cluster? You likely don't need this page: every deployment example (AWS, Azure, GCP, bare metal) already includes the complete provider block, and each cloud block is a few lines or nothing at all when the standard environment variables are set. Come back here to look up a specific setting.

The provider block covers three independent concerns. Set only the ones your configuration uses:

• Cloud blocks (aws, azure, gcp) hold account context for the infrastructure resources (qumulo_filesystem_aws, qumulo_filesystem_azure, qumulo_filesystem_gcp, qumulo_threat_detection_aws, qumulo_threat_detection_azure, qumulo_threat_detection_gcp, qumulo_neuralsearch_aws, qumulo_neuralsearch_azure, and qumulo_neuralsearch_gcp). Declare a block only when deploying to that cloud. Cloud API credentials come from each cloud's standard tooling (the AWS credential chain, az login, or GCP Application Default Credentials), never from the provider block.
• Connection profiles (connection_profiles) list the Qumulo clusters you manage. Cluster management resources (NFS, SMB, S3, quotas, portals, and the rest) reference a profile by name, so one provider block can manage any number of clusters. Managing an existing cluster, cloud or on-premises, needs no cloud credentials. It still needs nexus_api_token because the provider opens a Nexus session on every command.
• Nexus credentials (nexus_api_token, nexus_account_id) authenticate the provider to Qumulo Nexus. nexus_api_token is required for every Terraform command that configures the provider (plan, apply, destroy, import, and refresh), including configurations that use only connection profiles. The machine running Terraform reaches api.nexus.qumulo.com on TCP 443. nexus_account_id is needed only when the token spans more than one Nexus organization.

Example Usage

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  # Infrastructure deployment: declare only the block for the cloud you deploy to.
  azure {
    subscription_id = var.subscription_id
  }

  # Cluster management: define credentials once, reference by name in resources.
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://prod-cluster.example.com:8000"
      username             = "admin"
      password             = var.prod_cluster_password
      insecure_skip_verify = true # For clusters with self-signed certificates
    },
  ]
}

Environment Variable Fallbacks

Each setting below reads its environment variable only when the attribute is unset in the provider block; an explicit attribute always wins.

Provider setting	Environment variable	Notes
azure.subscription_id	ARM_SUBSCRIPTION_ID	Read even if the azure block is omitted.
azure.environment	ARM_ENVIRONMENT	Read even if the azure block is omitted; defaults to public.
gcp.project_id	GOOGLE_PROJECT	Read only when a gcp block is declared.
gcp.region	GOOGLE_REGION	Read only when a gcp block is declared.
nexus_api_token	QUMULO_NEXUS_API_TOKEN	Sensitive; prefer the environment variable or a Terraform variable over hardcoding.
nexus_account_id	QUMULO_NEXUS_ACCOUNT_ID	Must be a positive integer.

AWS has no provider-specific variables: credentials resolve through the standard AWS credential chain (AWS_PROFILE, access keys, shared config files, SSO, instance roles). Connection profile passwords have no environment fallback; inject them with Terraform variables (for example TF_VAR_prod_cluster_password).

Nexus roles

The Nexus user that owns the token needs the roles for every operation you run.

Operation	Nexus role
Every plan, apply, destroy, import, and refresh (the provider opens a Nexus session and resolves the organization)	Client View
Creating, scaling, replacing nodes in, or updating a qumulo_filesystem_aws, qumulo_filesystem_azure, or qumulo_filesystem_gcp cluster (registers the cluster and reads the Qumulo Core release catalog)	Client View
Destroying a cluster, or cleaning up after a failed create (marks the cluster DECOMMISSIONED in Nexus)	Admin or Cluster Management Admin
qumulo_threat_detection_aws, qumulo_threat_detection_azure, or qumulo_threat_detection_gcp (registers the appliance and revokes stale appliance secrets)	Threat Detection System Configurer, in addition to Client View

Without Admin or Cluster Management Admin, terraform destroy still deletes every cloud resource and finishes, but it ends with a warning and the cluster stays ACTIVE in Nexus until an administrator marks it DECOMMISSIONED by hand.

Next Steps

• Installing the provider and verifying registry trust: Install the provider
• Bringing existing clusters and settings under Terraform: Import Guide

Schema

Optional

• aws (Block, Optional) AWS-specific configuration for managing Qumulo filesystems on AWS. The AWS partition and account ID are derived automatically: partition from the resource's region (e.g. us-gov-* → aws-us-gov), account ID from STS. Only the shared-config profile is user-settable here. (see below for nested schema)
• azure (Block, Optional) Azure-specific provider configuration. Required for qumulo_filesystem_azure resources. (see below for nested schema)
• cluster_stall_window (String) How long a cluster operation may report no progress at all before the provisioner gives up on it. A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Defaults to 20m0s. This bounds silence, not work: while the cluster keeps reporting activity, node additions, removals and replacements run for as long as they need, so there is no maximum. Raise it for clusters whose membership changes are slow to settle. Lowering it risks failing an apply partway through an operation that was still progressing, which leaves the cluster mid-change.
• connection_profiles (Attributes List) Named connection profiles for Qumulo clusters. Resources reference these by name instead of specifying credentials inline.

Each profile defines the connection details for a single cluster. Use connection_profile in resources to reference them by name. (see below for nested schema) - gcp (Block, Optional) GCP-specific provider configuration. Required for qumulo_filesystem_gcp resources. (see below for nested schema) - nexus_account_id (Number) Qumulo Nexus organization ID to onboard newly-created clusters to.

Optional: when omitted, the provider auto-resolves the organization from the api_token's binding via GET /api/v1/auth/tokens/me. Required when the api_token spans multiple organizations; in that case the provider returns an actionable error at plan time enumerating your accessible organizations. Can also be set via the QUMULO_NEXUS_ACCOUNT_ID environment variable.

Note: the attribute is named nexus_account_id for parity with the Nexus REST API field (/api/v1/auth/tokens/me returns account_id), but it refers to a Nexus organization in operator-facing terms. - nexus_api_token (String, Sensitive) Qumulo Nexus API token. Required. It comes from a Nexus user whose roles cover the operations you run. See Nexus roles. Can also be set via the QUMULO_NEXUS_API_TOKEN environment variable. Treat this as a long-lived secret: store it in your secret manager and inject via var.nexus_api_token. - skip_provisioner_cleanup (Boolean) When true, a successful cluster create leaves the temporary provisioner VM and its signaling bucket in place instead of deleting them. Useful for debugging provisioning. The retained resources keep incurring cost until the next apply removes them or you delete them manually.

Nested Schema for aws

Optional:

• profile (String) AWS config profile name from ~/.aws/config.

Nested Schema for azure

Optional:

• environment (String) Azure cloud environment: public (default) or usgovernment. Can also be set via the ARM_ENVIRONMENT environment variable.
• provisioning_timeout_minutes (Number, Deprecated) Deprecated and ignored. The wait for the cluster boot-time provisioner now runs for as long as the resource's timeouts block allows, so this attribute no longer has any effect. Set timeouts.create on the filesystem resource instead.
• subscription_id (String) Azure subscription ID. Can also be set via the ARM_SUBSCRIPTION_ID environment variable.

Nested Schema for connection_profiles

Required:

• endpoint (String) Qumulo cluster REST API endpoint URL (e.g., https://cluster:8000).
• name (String) Unique name for this connection profile (e.g., prod, dr).
• password (String, Sensitive) Password for cluster authentication.
• username (String) Username for cluster authentication.

Optional:

• ca_certificate (String, Sensitive) PEM-encoded CA certificate to verify the cluster's certificate against. Use this for clusters with certificates signed by a private CA.
• insecure_skip_verify (Boolean) Skip TLS certificate verification. Required for clusters with self-signed certificates. Defaults to false (secure). Security warning: Only enable this for trusted clusters.
• nodes (Attributes List) Bare metal node SSH connection details for qumulo_filesystem_baremetal deployments. (see below for nested schema)

Nested Schema for connection_profiles.nodes

Required:

• ip (String) IP address of the bare metal node.

Optional:

• ssh_host_key (String) SSH host public key in authorized_keys format (e.g. "ssh-ed25519 AAAA...") for host key verification. If not set, host key verification is skipped.
• ssh_password (String, Sensitive) SSH password for authentication.
• ssh_port (Number) SSH port (default: 22).
• ssh_private_key (String, Sensitive) PEM-encoded SSH private key for authentication.
• ssh_user (String) SSH username (default: root).

Nested Schema for gcp

Optional:

• project_id (String) GCP project ID. Can also be set via the GOOGLE_PROJECT environment variable.
• region (String) GCP region (e.g. us-central1). Can also be set via the GOOGLE_REGION environment variable.