---
page_title: "yba_aws_provider Resource - YugabyteDB Anywhere"
description: |-
  AWS Cloud Provider Resource. Use this resource to create and manage AWS cloud providers in YugabyteDB Anywhere.
---

# yba_aws_provider (Resource)

AWS Cloud Provider Resource. Use this resource to create and manage AWS cloud providers in YugabyteDB Anywhere.

This resource provides a dedicated interface for AWS cloud providers with a simplified schema compared to the generic `yba_cloud_provider` resource.

## Credentials

You can provide AWS credentials in two ways:

1. **Access Keys**: Set `access_key_id` and `secret_access_key` fields
2. **IAM Instance Profile**: Set `use_iam_instance_profile = true` to use the IAM role attached to the YugabyteDB Anywhere host

-> **Note:** When using IAM instance profile, ensure the YBA host has an IAM role with sufficient permissions for EC2, VPC, and other required AWS services.

## Example Usage

### Basic AWS Provider with Access Keys

```terraform
# Basic AWS Provider with access keys
resource "yba_aws_provider" "example" {
  name              = "aws-provider"
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"

  regions {
    code              = "us-west-2"
    security_group_id = "<aws-sg-id>"
    vpc_id            = "<aws-vpc-id>"
    zones {
      code   = "us-west-2a"
      subnet = "<subnet-id-a>"
    }
    zones {
      code   = "us-west-2b"
      subnet = "<subnet-id-b>"
    }
  }

  air_gap_install = false
}

# AWS Provider using IAM Instance Profile
resource "yba_aws_provider" "iam_example" {
  name                     = "aws-iam-provider"
  use_iam_instance_profile = true

  regions {
    code              = "us-east-1"
    security_group_id = "<aws-sg-id>"
    vpc_id            = "<aws-vpc-id>"
    zones {
      code   = "us-east-1a"
      subnet = "<subnet-id>"
    }
  }

  air_gap_install = false
}

# AWS Provider with custom SSH key pair
resource "yba_aws_provider" "ssh_example" {
  name              = "aws-ssh-provider"
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"

  ssh_keypair_name        = "my-keypair"
  ssh_private_key_content = file("~/.ssh/my-keypair.pem")

  regions {
    code              = "us-west-2"
    security_group_id = "<aws-sg-id>"
    vpc_id            = "<aws-vpc-id>"
    zones {
      code   = "us-west-2a"
      subnet = "<subnet-id>"
    }
  }

  air_gap_install = false
}

# AWS Provider with custom image bundles and region overrides
resource "yba_aws_provider" "image_bundle_example" {
  name              = "aws-image-bundle-provider"
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"

  regions {
    code              = "us-west-2"
    security_group_id = "<aws-sg-id>"
    vpc_id            = "<aws-vpc-id>"
    zones {
      code   = "us-west-2a"
      subnet = "<subnet-id-a>"
    }
    zones {
      code   = "us-west-2b"
      subnet = "<subnet-id-b>"
    }
  }

  image_bundles {
    name           = "custom-x86-bundle"
    use_as_default = true
    details {
      arch     = "x86_64"
      ssh_user = "ec2-user"
      ssh_port = 22
      region_overrides = {
        "us-west-2" = "<ami-id-for-us-west-2>"
      }
    }
  }

  image_bundles {
    name           = "custom-arm-bundle"
    use_as_default = false
    details {
      arch     = "aarch64"
      ssh_user = "ec2-user"
      ssh_port = 22
      region_overrides = {
        "us-west-2" = "<arm-ami-id-for-us-west-2>"
      }
    }
  }

  air_gap_install = false
}

# AWS Provider with NTP configuration
resource "yba_aws_provider" "ntp_example" {
  name              = "aws-ntp-provider"
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"

  regions {
    code              = "us-west-2"
    security_group_id = "<aws-sg-id>"
    vpc_id            = "<aws-vpc-id>"
    zones {
      code   = "us-west-2a"
      subnet = "<subnet-id>"
    }
  }

  # Use AWS Time Sync service
  set_up_chrony = true

  air_gap_install = false
}

# AWS Provider with Route53 hosted zone
resource "yba_aws_provider" "route53_example" {
  name              = "aws-route53-provider"
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"

  hosted_zone_id = "<route53-hosted-zone-id>"

  regions {
    code              = "us-west-2"
    security_group_id = "<aws-sg-id>"
    vpc_id            = "<aws-vpc-id>"
    zones {
      code   = "us-west-2a"
      subnet = "<subnet-id>"
    }
  }

  air_gap_install = false
}
```

The details for configuration are available in the [YugabyteDB Anywhere Configure Cloud Provider Documentation](https://docs.yugabyte.com/stable/yugabyte-platform/configure-yugabyte-platform/set-up-cloud-provider/aws/).

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Name of the provider.
- `regions` (Block List, Min: 1) AWS regions associated with the provider. (see [below for nested schema](#nestedblock--regions))

### Optional

- `access_key_id` (String, Sensitive) AWS Access Key ID. Required for non-IAM role based providers. Stored in Terraform state - use an encrypted backend for security.
- `air_gap_install` (Boolean) Flag indicating if YugabyteDB nodes are installed in an air-gapped environment, lacking access to the public internet for package downloads. Default is false.
- `hosted_zone_id` (String) Hosted Zone ID corresponding to Amazon Route53.
- `image_bundles` (Block List) Custom image bundles for the AWS provider. At least one image_bundles or yba_managed_image_bundles block must be specified. Every bundle must supply a non-empty AMI in region_overrides for each configured region. (see [below for nested schema](#nestedblock--image_bundles))
- `ntp_servers` (List of String) List of NTP servers for time synchronization.
- `secret_access_key` (String, Sensitive) AWS Secret Access Key. Required with access_key_id. Stored in Terraform state - use an encrypted backend for security.
- `set_up_chrony` (Boolean) Set up NTP chrony service. When true with empty ntp_servers, uses cloud provider's NTP server (e.g., AWS Time Sync). When true with ntp_servers specified, uses custom NTP servers. When false, assumes NTP is pre-configured in the machine image. Default is false.
- `skip_ssh_keypair_validation` (Boolean) Skip SSH keypair validation and upload to AWS. Only applies in self-managed mode (when ssh_keypair_name and ssh_private_key_content are set). Use when the keypair already exists in your AWS account and you do not want to grant YBA describe/create keypair permissions. Default is false.
- `ssh_keypair_name` (String) Custom SSH key pair name to access YugabyteDB nodes. Must be set together with ssh_private_key_content (self-managed mode). If both ssh_keypair_name and ssh_private_key_content are omitted, YugabyteDB Anywhere generates and manages the key pair (YBA-managed mode). YBA versions keys on every update: if a key with this name already exists it appends a timestamp (e.g. 'my-key-2026-03-18-10-01-29'). Use access_key_code to read the actual versioned name that was stored.
- `ssh_private_key_content` (String, Sensitive) SSH private key content to access YugabyteDB nodes. Must be set together with ssh_keypair_name (self-managed mode). If both fields are omitted, YugabyteDB Anywhere generates and manages the key pair (YBA-managed mode). Stored in Terraform state - use an encrypted backend for security.
- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
- `use_iam_instance_profile` (Boolean) Use IAM Role from the YugabyteDB Anywhere host. Provider creation will fail on insufficient permissions. Default is false.
- `yba_managed_image_bundles` (Block List, Max: 2) YBA managed image bundles for the provider. At least one image_bundles or yba_managed_image_bundles block must be specified. AWS supports up to two entries: one for x86_64 and one for aarch64. Omit this block to stop managing YBA default images via Terraform (any previously tracked bundles will be removed from the provider on the next apply). (see [below for nested schema](#nestedblock--yba_managed_image_bundles))

### Read-Only

- `access_key_code` (String) Access key code for this provider. Read-only, generated by YBA.
- `enable_node_agent` (Boolean) Flag indicating if node agent is enabled for this provider. Read-only.
- `host_vpc_id` (String) AWS Host VPC ID. Read-only, populated by YBA.
- `host_vpc_region` (String) AWS Host VPC Region. Read-only, populated by YBA.
- `hosted_zone_name` (String) Hosted Zone Name corresponding to Amazon Route53. Read-only.
- `id` (String) The ID of this resource.
- `version` (Number) Provider version. Read-only, incremented on each update.
- `vpc_type` (String) VPC type: EXISTING or NEW. Read-only.

<a id="nestedblock--regions"></a>

### Nested Schema for `regions`

Required:

- `code` (String) AWS region code (e.g., us-west-2, us-east-1).
- `zones` (Block List, Min: 1) Availability zones in this region. (see [below for nested schema](#nestedblock--regions--zones))

Optional:

- `security_group_id` (String) Security group ID for this region.
- `vpc_id` (String) VPC ID for this region.

Read-Only:

- `name` (String) AWS region name. Read-only.
- `uuid` (String) Region UUID.

<a id="nestedblock--regions--zones"></a>

### Nested Schema for `regions.zones`

Required:

- `code` (String) AWS availability zone code (e.g., us-west-2a, us-east-1b).
- `subnet` (String) Subnet ID for this zone.

Optional:

- `secondary_subnet` (String) Secondary subnet ID for this zone.

Read-Only:

- `name` (String) AWS availability zone name. Read-only.
- `uuid` (String) Zone UUID.

<a id="nestedblock--image_bundles"></a>

### Nested Schema for `image_bundles`

Required:

- `details` (Block List, Min: 1, Max: 1) Image bundle details including architecture, SSH configuration, and region overrides. (see [below for nested schema](#nestedblock--image_bundles--details))
- `name` (String) Name of the image bundle.

Optional:

- `use_as_default` (Boolean) Flag indicating if the image bundle should be used as default for this architecture. When no bundle for a given architecture has this set to true, YBA automatically promotes the first bundle as default. Terraform will suppress the resulting true->false drift in the plan.

Read-Only:

- `metadata_type` (String) Bundle type: YBA_ACTIVE (YBA-managed), YBA_DEPRECATED, or CUSTOM.
- `uuid` (String) Image bundle UUID.

<a id="nestedblock--image_bundles--details"></a>

### Nested Schema for `image_bundles.details`

Required:

- `arch` (String) Image bundle architecture. Allowed values: x86_64, aarch64.
- `ssh_user` (String) SSH user for the image.

Optional:

- `region_overrides` (Map of String) Per-region AMI IDs for AWS. Key is the region code (e.g. us-east-1), value is the AMI ID. A non-empty AMI must be provided for every region configured in the provider. Validation enforces this at plan time.
- `ssh_port` (Number) SSH port for the image. Default is 22.
- `use_imds_v2` (Boolean) Use IMDS v2 for the image. Default is true. Set to false to allow IMDSv1 (not recommended). Note: Terraform may show a cosmetic plan-time warning for this field when omitted from config - this is a known legacy SDK limitation and does not affect behaviour.

<a id="nestedblock--timeouts"></a>

### Nested Schema for `timeouts`

Optional:

- `create` (String)
- `delete` (String)
- `update` (String)

<a id="nestedblock--yba_managed_image_bundles"></a>

### Nested Schema for `yba_managed_image_bundles`

Required:

- `arch` (String) Image bundle architecture. Allowed values: x86_64, aarch64.

Optional:

- `use_as_default` (Boolean) Flag indicating if the image bundle should be used as default for this architecture. When no bundle for a given architecture has this set to true, YBA automatically promotes the first bundle as default. Terraform will suppress the resulting true->false drift in the plan.

Read-Only:

- `name` (String) Image bundle name assigned by YBA.
- `uuid` (String) Image bundle UUID.

## Migration from `yba_cloud_provider`

If you previously managed AWS providers with the deprecated [`yba_cloud_provider`](cloud_provider) resource, switch the block type, lift `aws_config_settings.*` to top-level fields, and re-import the state:

```hcl
# Before (deprecated)
resource "yba_cloud_provider" "aws" {
  code = "aws"
  name = "aws-provider"
  aws_config_settings {
    access_key_id     = "<aws-access-key-id>"
    secret_access_key = "<aws-secret-access-key>"
  }
  regions {
    code      = "us-west-2"
    vnet_name = "<aws-vpc-id>"
    # ...
  }
}

# After
resource "yba_aws_provider" "aws" {
  name              = "aws-provider"
  access_key_id     = "<aws-access-key-id>"
  secret_access_key = "<aws-secret-access-key>"
  regions {
    code   = "us-west-2"
    vpc_id = "<aws-vpc-id>"
    # ...
  }
}
```

Then re-bind the state to the new address:

```sh
terraform state rm yba_cloud_provider.aws
terraform import yba_aws_provider.aws <provider-uuid>
```

Notable schema differences:

- `aws_config_settings.{access_key_id, secret_access_key, use_iam_instance_profile, hosted_zone_id}` are now top-level fields.
- `regions.vnet_name` is renamed to `regions.vpc_id`.
- The top-level `code`, `dest_vpc_id`, `host_vpc_id`, and `host_vpc_region` fields are not used.

## Import

AWS Providers can be imported using the provider UUID:

```sh
terraform import yba_aws_provider.example <provider-uuid>
```

## Known Issues

### Zone ordering diff

YugabyteDB Anywhere may return availability zones in a different order from the one specified in your configuration. Because `zones` is a `TypeList` (order-sensitive), Terraform can produce a cosmetic plan diff that looks like zones are being swapped or removed even when no real change is intended:

```
~ zones {
    ~ code   = "us-west-2c" -> "us-west-2b"
      subnet = ...
  }
- zones {
    - code   = "us-west-2b" -> null
    ...
  }
```

**This diff is cosmetic.** The underlying zone configuration is unchanged; only the positional order differs. Applying will not modify any infrastructure. To avoid seeing this diff repeatedly, define your `zones` blocks in the same order that YBA returns them -- check the `terraform show` output after the first successful apply and reorder your config to match.

### Plan-time warnings for new image bundle attributes

When adding a new `image_bundles` block, Terraform may emit warnings of the form `was null, but now cty.StringVal(...)` for computed sub-fields such as `uuid`, `metadata_type`, `ssh_port`, and `global_yb_image`. These are cosmetic warnings caused by a limitation in the legacy Terraform Plugin SDK's handling of nested computed attributes inside `TypeList` blocks. They do not affect apply behaviour and can be safely ignored.