Skip to content

Provider Reference

Reference for the qumulo provider block: cloud deployment blocks, cluster connection profiles, and Nexus integration.

Deploying a cluster? You likely don't need this page: every deployment example (AWS, Azure, GCP, bare metal) already includes the complete provider block, and each cloud block is a few lines or nothing at all when the standard environment variables are set. Come back here to look up a specific setting.

The provider block covers three independent concerns. Set only the ones your configuration uses:

  • Cloud blocks (aws, azure, gcp) hold account context for the infrastructure resources (qumulo_filesystem_*, qumulo_threat_detection_*). Declare a block only when deploying to that cloud. Cloud API credentials come from each cloud's standard tooling (the AWS credential chain, az login, or GCP Application Default Credentials), never from the provider block.
  • Connection profiles (connection_profiles) list the Qumulo clusters you manage. Cluster management resources (NFS, SMB, S3, quotas, portals, and the rest) reference a profile by name, so one provider block can manage any number of clusters. This is all you need to manage an existing cluster, cloud or on-premises. No cloud credentials required.
  • Nexus credentials (nexus_api_token, nexus_account_id) are needed only when you declare Threat Detection resources.

Example Usage

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  # Infrastructure deployment: declare only the block for the cloud you deploy to.
  azure {
    subscription_id = var.subscription_id
  }

  # Cluster management: define credentials once, reference by name in resources.
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://prod-cluster.example.com:8000"
      username             = "admin"
      password             = var.prod_cluster_password
      insecure_skip_verify = true # For clusters with self-signed certificates
    },
  ]
}

Environment Variable Fallbacks

Each setting below reads its environment variable only when the attribute is unset in the provider block; an explicit attribute always wins.

Provider setting Environment variable Notes
azure.subscription_id ARM_SUBSCRIPTION_ID Read even if the azure block is omitted.
azure.environment ARM_ENVIRONMENT Read even if the azure block is omitted; defaults to public.
gcp.project_id GOOGLE_PROJECT Read only when a gcp block is declared.
gcp.region GOOGLE_REGION Read only when a gcp block is declared.
nexus_api_token QUMULO_NEXUS_API_TOKEN Sensitive; prefer the environment variable or a Terraform variable over hardcoding.
nexus_account_id QUMULO_NEXUS_ACCOUNT_ID Must be a positive integer.

AWS has no provider-specific variables: credentials resolve through the standard AWS credential chain (AWS_PROFILE, access keys, shared config files, SSO, instance roles). Connection profile passwords have no environment fallback; inject them with Terraform variables (for example TF_VAR_prod_cluster_password).

Next Steps

Schema

Optional

  • aws (Block, Optional) AWS-specific configuration for managing Qumulo filesystems on AWS. The AWS partition and account ID are derived automatically: partition from the resource's region (e.g. us-gov-* → aws-us-gov), account ID from STS. Only the shared-config profile is user-settable here. (see below for nested schema)
  • azure (Block, Optional) Azure-specific provider configuration. Required for qumulo_filesystem_azure resources. (see below for nested schema)
  • connection_profiles (Attributes List) Named connection profiles for Qumulo clusters. Resources reference these by name instead of specifying credentials inline.

Each profile defines the connection details for a single cluster. Use connection_profile in resources to reference them by name. (see below for nested schema) - gcp (Block, Optional) GCP-specific provider configuration. Required for qumulo_filesystem_gcp resources. (see below for nested schema) - nexus_account_id (Number) Qumulo Nexus organization ID to onboard newly-created clusters to.

Optional: when omitted, the provider auto-resolves the organization from the api_token's binding via GET /api/v1/auth/tokens/me. Required when the api_token spans multiple organizations; in that case the provider returns an actionable error at plan time enumerating your accessible organizations. Can also be set via the QUMULO_NEXUS_ACCOUNT_ID environment variable.

Note: the attribute is named nexus_account_id for parity with the Nexus REST API field (/api/v1/auth/tokens/me returns account_id), but it refers to a Nexus organization in operator-facing terms. - nexus_api_token (String, Sensitive) Qumulo Nexus API token. Required when any Threat Detection resource (qumulo_threat_detection_azure, qumulo_threat_detection_aws, qumulo_threat_detection_gcp) is declared. The token must include Threat Detection system management on the target account (for example THREAT_DETECTION_SYSTEM_CONFIGURER) so the provider can revoke orphan bearer secrets during apply/destroy; create-only roles (VIEWER/CLIENT_VIEW) are insufficient when a prior apply left Nexus state behind. Can also be set via the QUMULO_NEXUS_API_TOKEN environment variable. Treat this as a long-lived secret: store it in your secret manager and inject via var.nexus_api_token. - skip_provisioner_cleanup (Boolean) When true, a successful cluster create leaves the temporary provisioner VM and its signaling bucket in place instead of deleting them. Useful for debugging provisioning. The retained resources keep incurring cost until the next apply removes them or you delete them manually.

Nested Schema for aws

Optional:

  • profile (String) AWS config profile name from ~/.aws/config.

Nested Schema for azure

Optional:

  • environment (String) Azure cloud environment: public (default) or usgovernment. Can also be set via the ARM_ENVIRONMENT environment variable.
  • provisioning_timeout_minutes (Number) Maximum minutes to wait for the cluster boot-time provisioner to report completion during create and scale. Defaults to 30. Bump this when targeting a slower environment (e.g. a busy test subscription, larger node counts) so the apply does not bail before quorum forms. Must be between 5 and 240.
  • subscription_id (String) Azure subscription ID. Can also be set via the ARM_SUBSCRIPTION_ID environment variable.

Nested Schema for connection_profiles

Required:

  • endpoint (String) Qumulo cluster REST API endpoint URL (e.g., https://cluster:8000).
  • name (String) Unique name for this connection profile (e.g., prod, dr).
  • password (String, Sensitive) Password for cluster authentication.
  • username (String) Username for cluster authentication.

Optional:

  • ca_certificate (String, Sensitive) PEM-encoded CA certificate to verify the cluster's certificate against. Use this for clusters with certificates signed by a private CA.
  • insecure_skip_verify (Boolean) Skip TLS certificate verification. Required for clusters with self-signed certificates. Defaults to false (secure). Security warning: Only enable this for trusted clusters.
  • nodes (Attributes List) Bare metal node SSH connection details for qumulo_filesystem_baremetal deployments. (see below for nested schema)

Nested Schema for connection_profiles.nodes

Required:

  • ip (String) IP address of the bare metal node.

Optional:

  • ssh_host_key (String) SSH host public key in authorized_keys format (e.g. "ssh-ed25519 AAAA...") for host key verification. If not set, host key verification is skipped.
  • ssh_password (String, Sensitive) SSH password for authentication.
  • ssh_port (Number) SSH port (default: 22).
  • ssh_private_key (String, Sensitive) PEM-encoded SSH private key for authentication.
  • ssh_user (String) SSH username (default: root).

Nested Schema for gcp

Optional:

  • project_id (String) GCP project ID. Can also be set via the GOOGLE_PROJECT environment variable.
  • region (String) GCP region (e.g. us-central1). Can also be set via the GOOGLE_REGION environment variable.