---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "YugabyteDB Anywhere Provider"
description: |-
  Terraform Provider to configure and manage entities in YugabyteDB Anywhere
---

# YugabyteDB Anywhere Provider

[YugabyteDB](https://github.com/yugabyte/yugabyte-db) is a high-performance, cloud-native distributed SQL database that aims to support all PostgreSQL features. It is a best fit for cloud-native OLTP (i.e. real-time, business-critical) applications that need absolute data correctness and require at least one of the following: scalability, high tolerance to failures, or globally-distributed deployments.
[YugabyteDB Anywhere](https://www.yugabyte.com/anywhere/) is a control plane for managing YugabyteDB universes across hybrid and multi-cloud environments, and provides automation and orchestration capabilities.

The YugabyteDB Anywhere Provider currently supports the following YugabyteDB Anywhere entities:

- Data Sources:
  - Backup Information (yba_backup_info)
  - Preflight checks for Nodes used in on-premises Providers (yba_onprem_preflight)
  - Filters for Nodes in on-premises Providers (yba_onprem_nodes)
  - Filters for Providers (yba_provider_filter)
  - Provider Image Bundles (yba_provider_image_bundles)
  - Cloud Provider Access Key Information (yba_provider_key)
  - Provider Region Information (yba_provider_regions)
  - Available YBDB Release Versions (yba_release_version)
  - Storage Configuration Information (yba_storage_configs)
  - Filters for Universes (yba_universe_filter)
  - Universe Schema (namespaces and tables) (yba_universe_schema)

- Resources:
  - Backups (yba_backup)
  - Backup Schedules (yba_backup_schedule)
  - AWS Cloud Provider (yba_aws_provider)
  - Azure Cloud Provider (yba_azure_provider)
  - GCP Cloud Provider (yba_gcp_provider)
  - Customer (yba_customer_resource)
  - YugabyteDB Anywhere Installation via YBA Installer (yba_installer)
  - On-Premises Node Instance (yba_onprem_node_instance)
  - On-Premises Provider (yba_onprem_provider)
  - Restores (yba_restore)
  - Storage Configuration - AWS S3 (yba_s3_storage_config)
  - Storage Configuration - Azure Blob (yba_azure_storage_config)
  - Storage Configuration - GCS (yba_gcs_storage_config)
  - Storage Configuration - NFS (yba_nfs_storage_config)
  - Universe (yba_universe)

- Deprecated Resources (supported through the v1.x line; planned for removal in v2.0.0):
  - Backup Schedules - Deprecated (yba_backups)
  - Cloud Provider - Deprecated (yba_cloud_provider)
  - Storage Configuration - Deprecated (yba_storage_config_resource)

Configure the provider with appropriate credentials before you use it.

-> **Note:** The YugabyteDB Anywhere Terraform Provider is currently in Early Access and testing is in progress.

~> **Note:** The YugabyteDB Anywhere Terraform provider requires YugabyteDB Anywhere stable version 2024.2.0.0 or later, or preview version 2.23.1.0 or later.

~> **Note:** Kubernetes universes are currently not supported.

## Example Usage

```terraform
terraform {
  required_providers {
    yba = {
      source  = "yugabyte/yba"
      version = "~> 1.0"
    }
  }
}

provider "yba" {
  // unauthenticated - to use provider for installation of YugabyteDB Anywhere and customer creation
  alias = "unauthenticated"
  host  = "<host-ip-address>"
}

provider "yba" {
  // after customer creation, use authenticated provider
  host      = "<host-ip-address>"
  api_token = "<customer-api-token>"
}

provider "yba" {
  // For HTTP based YugabyteDB Anywhere applications
  enable_https = false
  host         = "<host-ip-address>:80"
  api_token    = "<customer-api-token>"
}
```

Pin to `~> 1.0` to stay on the v1.x line. The deprecated `yba_cloud_provider`, `yba_storage_config_resource`, and `yba_backups` resources continue to work throughout v1.x; their planned removal is v2.0.0. See the [Upgrading to v1.0.0](guides/upgrading-to-v1.0.0) guide for migration steps.

<!-- schema generated by tfplugindocs -->
## Schema

### Optional

- **api_token** (String) YugabyteDB Anywhere Customer API Token.
- **enable_https** (Boolean) Connection to YugabyteDB Anywhere application via HTTPS. True by default.
- **host** (String) IP address or Domain Name with port for the YugabyteDB Anywhere application.

## Configuration

The YugabyteDB Anywhere provider reads its configuration from the following sources, in order:

1. Parameters in the provider configuration
1. Environment variables

Configure the provider by adding `host` and, optionally, `api_token` and `enable_https` to the `yba` provider block.

Usage:

```terraform
provider "yba" {
  enable_https = true
  host         = "<host-ip-address>"
  api_token    = "<customer-api-token>"
}
```

### Environment Variables

Configuration can also be provided through environment variables. The provider prefers the `YBA_`-prefixed names; the legacy `YB_`-prefixed names remain as fallbacks for backwards compatibility.

| Provider field | Preferred env var | Legacy fallback |
|---|---|---|
| `host` | `YBA_HOST` | `YB_HOST` |
| `api_token` | `YBA_API_TOKEN` (or `YBA_API_KEY`) | `YB_API_KEY` |
| `enable_https` | `YBA_ENABLE_HTTPS` | `YB_ENABLE_HTTPS` |

For `api_token`, the resolution order is `YBA_API_TOKEN` -> `YBA_API_KEY` -> `YB_API_KEY`. Use the preferred names in new pipelines; the legacy names will be kept through the v1.x line.

For example:

```terraform
provider "yba" {}
```

```sh
export YBA_HOST="<host-ip-address>"
export YBA_API_TOKEN="<customer-api-token>"
export YBA_ENABLE_HTTPS=true
terraform plan
```

-> **Note:** Installation of YugabyteDB Anywhere and customer creation do not require a Customer API Token. All subsequent operations, including reading the customer resource and creating cloud providers, universes, and so on, require a fresh `yba` provider to be defined with the [API token](https://api-docs.yugabyte.com/docs/yugabyte-platform/f10502c9c9623-yugabyte-db-anywhere-api-overview#api-tokens-and-uuids). Failing to do so would result in a ***403 Forbidden*** error while accessing the resources.

## Managing drift from out-of-band changes

Resources managed by this provider can also be modified directly through the YugabyteDB Anywhere UI or API. When that happens, the live state in YBA drifts from the configuration in your Terraform files. Terraform treats its own configuration as the source of truth, so a subsequent `terraform apply` will revert those out-of-band changes unless drift is reconciled first.

Drift is unavoidable for operations this provider does not expose - for example, TLS certificate rotation, YSQL / YCQL password rotation, and KMS / encryption-at-rest configuration changes. Perform these through the YBA UI / API and reconcile the corresponding `.tf` fields (or `lifecycle.ignore_changes` block) afterwards.

~> **Warning:** When you mix UI, API, or CLI changes with Terraform-managed resources, do **not** use `terraform apply -auto-approve`. The `-auto-approve` flag suppresses the confirmation prompt that would otherwise show the reverting changes, allowing accidental overwrites of out-of-band edits.

### Recommended workflow

1. Always run `terraform plan` before `terraform apply`. The plan output is the authoritative drift report and lists every field Terraform intends to change.
2. Review the plan output for any changes you did not intend. If you see drift caused by an out-of-band edit, either:
   - Update your `.tf` configuration to match the new state in YBA, then re-run `terraform plan` to confirm no changes remain, or
   - Run `terraform apply` to deliberately revert YBA back to the configuration in your `.tf` files.
3. Only run `terraform apply` (without `-auto-approve`) once the plan matches your intent. Terraform will print the diff again and prompt for `yes` before applying.

### Automated pipelines (`-detailed-exitcode`)

For CI/CD pipelines that run Terraform unattended, gate `apply` on `plan -detailed-exitcode` so the pipeline pauses for human review whenever drift is detected:

```sh
# Exit code 0 = no changes, 1 = error, 2 = changes (drift or intentional updates)
terraform plan -detailed-exitcode -out=tfplan
# Branch on the exit code in your pipeline; only auto-apply when it is 0.
terraform apply tfplan
```

When the plan exit code is `2`, route the saved `tfplan` to a reviewer. This effectively replaces the interactive `yes` prompt with a manual approval step in automation.

### Reconciling drift

For broader guidance on importing existing infrastructure, accepting drifted values into state, or reverting them via Terraform, see HashiCorp's tutorial: [Manage resource drift](https://developer.hashicorp.com/terraform/tutorials/state/resource-drift).