Getting started with Terraform

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

To create your first infrastructure in Yandex Cloud using Terraform:

1. Get your cloud ready.
2. Install Terraform.
3. Get the authentication credentials.
4. Create a Terraform configuration file.
5. Configure your provider.
6. Prepare an infrastructure plan.
7. Check and format your configuration files.
8. Create resources.

If you no longer need the resources, delete them.

Get your cloud readyGet your cloud ready

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

The cost of support for the infrastructure deployed through Terraform in this tutorial includes:

• Fee for continuously running VMs (see Yandex Compute Cloud pricing).
• Fee for using a dynamic public IP address (see Yandex Virtual Private Cloud pricing).

Install TerraformInstall Terraform

From a mirrorFrom a mirror

You can download a Terraform distribution for your platform from a mirror. When the download is complete, add the path to the folder with the executable to the PATH variable:

export PATH=$PATH:/path/to/terraform

From the HashiCorp websiteFrom the HashiCorp website

Get the authentication credentialsGet the authentication credentials

To authenticate and manage your Yandex Cloud infrastructure, you can use Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user).

provider "yandex" {
  # Do not specify `cloud_id`, `folder_id`, or `token`, as
  # your provider automatically fetches them from the environment variables

  zone = "<availability_zone>"
}

provider "yandex" {
  # Do not specify `cloud_id`, `folder_id`, or `token`, as
  # your provider automatically fetches them from the environment variables

  zone = "<availability_zone>"
}

Create a Terraform configuration fileCreate a Terraform configuration file

1. Create a new directory with any name, for example, cloud-terraform. It stores the configuration files and saved states for Terraform and your infrastructure.

   Warning

   Each configuration must be in a separate directory.

2. Create a configuration file with the .tf extension in this directory, such as main.tf.

Configure your providerConfigure your provider

1. If you previously configured a provider from the HashiCorp registry, save its settings:

   Linux/macOS

   Windows

   mv ~/.terraformrc ~/.terraformrc.old
   

   mv $env:APPDATA/terraform.rc $env:APPDATA/terraform.rc.old
   

2. Specify the source the provider will be installed from.

   Linux/macOS

   Windows

   Open the Terraform CLI configuration file:

   nano ~/.terraformrc
   

   Note

   The .terraformrc file must be in the user's home root folder, e.g., /home/user/ or /User/user/.

   Open the Terraform CLI terraform.rc configuration file in your user's %APPDATA% folder.

   To find out the absolute path to the %APPDATA% folder, run the echo %APPDATA% command for cmd or the $env:APPDATA command for PowerShell.

   Add the following section to the file:

   provider_installation {
     network_mirror {
       url = "https://terraform-mirror.yandexcloud.net/"
       include = ["registry.terraform.io/*/*"]
     }
     direct {
       exclude = ["registry.terraform.io/*/*"]
     }
   }
   

   For more information about setting up mirrors, see the documentation.

3. At the beginning of the .tf configuration file, add the following sections:

   terraform {
     required_providers {
       yandex = {
         source = "yandex-cloud/yandex"
       }
     }
     required_version = ">= 0.13"
   }
   
   provider "yandex" {
     zone = "<default_availability_zone>"
   }
   

   Where:

   • source: Provider's global source address.
   • required_version: Minimum Terraform version the provider is compatible with.
   • provider: Provider name.
   • zone: Default availability zone for all your cloud resources.

4. Run the terraform init command in the folder with the .tf configuration file. This command initializes the providers specified in the configuration files and allows you to work with the provider resources and data sources.

If the provider installation failed, create a support request indicating the provider name and version.

If you used the .terraform.lock.hcl file, run the terraform providers lock command prior to the initialization specifying the URL of the mirror to upload the provider from and the platforms the configuration will run on:

terraform providers lock -net-mirror=https://terraform-mirror.yandexcloud.net -platform=<platform_name_1> -platform=<platform_name_2> yandex-cloud/yandex

Where:

• -net-mirror: Address of the mirror to upload the provider from.
• -platform: Platforms to use the configuration on. The possible values are:
  • windows_amd64: Windows 64-bit.
  • linux_amd64: Linux 64-bit.
  • darwin_arm64: macOS 64-bit.

If you used the Terraform modules, first run terraform init, then delete the lock file. After that, run the terraform providers lock command.

For more information about the terraform providers lock command, see this Terraform article.

Prepare an infrastructure planPrepare an infrastructure plan

With Terraform in Yandex Cloud, you can create cloud resources of any type: VMs, disks, images, etc. For more information about the resources you can create with Terraform, see this provider guide.

To create a resource, specify a set of required and optional parameters that define the resource properties. Such resource descriptions make up the infrastructure plan.

The plan includes creating two VMs, terraform1 and terraform2, as well as a cloud network named network-1 with a subnet named subnet-1.

Resource names must meet the following requirements:

• Length: between 3 and 63 characters.
• It can only contain lowercase Latin letters, numbers, and hyphens.
• It must start with a letter and cannot end with a hyphen.

The VMs will have different vCPU and memory configurations: 2 vCPUs and 2 GB of RAM for terraform1 and 4 vCPUs and 4 GB of RAM for terraform2. The VMs will be automatically assigned public and private IP addresses from the 192.168.10.0/24 range in subnet-1 located in the ru-central1-d availability zone and belonging to the network-1 cloud network. The VMs will run Ubuntu OS and host the public part of the key to enable SSH access to the VMs.

In the VM configuration, you will need to specify the boot disk image ID. You can get a list of available public images using this CLI command:

yc compute image list --folder-id standard-images

To access the VMs over SSH, generate an SSH key pair and communicate the public key to the VM in the ssh-keys parameter of the metadata section.

Resource configurations are specified immediately after the provider's configuration:

terraform {
  required_providers {
    yandex = {
      source = "yandex-cloud/yandex"
    }
  }
}

provider "yandex" {
  zone = "<default_availability_zone>"
}

resource "yandex_compute_instance" "vm-1" {
  name = "terraform1"
}

Create usersCreate users

#ps1
# ^^^ 'ps1' is only for cloudbase-init, some sort of sha-bang in linux

# logging
Start-Transcript -Path "$ENV:SystemDrive\provision.txt" -IncludeInvocationHeader -Force
"Bootstrap script started" | Write-Host

# inserting value's from terraform
$MyUserName = "${ user_name }"
$MyPlainTextPassword = "${ user_pass }"
if (-not [string]::IsNullOrEmpty($MyUserName) -and -not [string]::IsNullOrEmpty($MyPlainTextPassword)) {
    "Create user" | Write-Host
    $MyPassword = $MyPlainTextPassword | ConvertTo-SecureString -AsPlainText -Force
    $MyUser = New-LocalUser -Name $MyUserName -Password $MyPassword -PasswordNeverExpires -AccountNeverExpires
    $MyUser | Add-LocalGroupMember -Group 'Administrators'
    $MyUser | Add-LocalGroupMember -Group 'Remote Management Users'
}

# inserting value's from terraform
$MyAdministratorPlainTextPassword = "${ admin_pass }"
if (-not [string]::IsNullOrEmpty($MyAdministratorPlainTextPassword)) {
    "Set local administrator password" | Write-Host
    $MyAdministratorPassword = $MyAdministratorPlainTextPassword | ConvertTo-SecureString -AsPlainText -Force
    # S-1-5-21domain-500 is a well-known SID for Administrator
    # https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/security-identifiers-in-windows
    $MyAdministrator = Get-LocalUser | Where-Object -Property "SID" -like "S-1-5-21-*-500"
    $MyAdministrator | Set-LocalUser -Password $MyAdministratorPassword
}

"Bootstrap script ended" | Write-Host

Check and format the configuration filesCheck and format the configuration files

1. Check the configuration using this command:

   terraform validate
   

   If the configuration is valid, you will get this message:

   Success! The configuration is valid.
   

2. Format the configuration files in the current folder and subfolders:

   terraform fmt
   

   Result:

   main.tf
   variables.tf
   

Create resourcesCreate resources

1. After checking the configuration, run the command:

   terraform plan
   

   The terminal will display a list of resources with parameters. This is a test step; no resources will be created. If the configuration contains any errors, Terraform will point them out.

   Alert

   You will be charged for all the resources created with Terraform. Check the pricing plan carefully.

2. To create resources, run the command:

   terraform apply
   

3. Confirm creating the resources: type yes in the terminal and press Enter.

   Terraform will create all the required resources and the terminal will display the IP addresses of the created VMs. You can check the new resources and their configuration using the management console.

How to delete the resources you createdHow to delete the resources you created

To delete the resources created with Terraform:

1. Run this command:

   terraform destroy
   

   Alert

   Terraform will delete all the resources you created in the current configuration, such as clusters, networks, subnets, and VMs.

   After the command is executed, the terminal will display a list of resources to be deleted.

2. Type yes and press Enter.

You can check the deletion of the resources using the management console.

See alsoSee also

• Uploading Terraform states to Object Storage.
• Locking Terraform states using Managed Service for YDB.
• Using Yandex Cloud modules in Terraform.
• Terraform data sources.
• IaC: Terraform: Training course on managing a cloud infrastructure using Terraform.