[Yandex Cloud documentation](../../../index.md) > [Yandex Compute Cloud](../../index.md) > [Step-by-step guides](../index.md) > Creating an image > Uploading a custom image # Uploading a custom disk image to Yandex Cloud This guide explains how to upload a Linux image file to [Yandex Object Storage](../../../storage/index.md) and use it to create an [image](../../concepts/image.md) and a [VM](../../concepts/vm.md) in Compute Cloud. Major virtualization systems are supported. {% note warning %} In Compute Cloud, you can only create images using files uploaded to Object Storage. You can also migrate a VM using [Hystax Acura](../../../tutorials/infrastructure-management/hystax-migration.md). {% endnote %} ## Prepare an image file {#prepare-file} For boot disk images, the following requirements apply: * The `virtio-net`, `virtio-blk`, and `virtio-pci` drivers are installed. If you are going to attach [file storages](../../concepts/filesystem.md) to your [VM](../../concepts/vm.md), you also need to install the `virtiofs` driver. See [this guide](custom-image.md#virtio). * The `ttyS0` terminal (COM1) is configured as the [serial console](../../concepts/serial-console.md). See [this guide](custom-image.md#serial-console). * The network interface runs correctly when starting the VM and gets the [IP address](../../../vpc/concepts/address.md) via DHCP. * The `cloud-init` package is installed and configured to work with our [metadata service](../vm-info/get-info.md#inside-instance). Run `sudo yum install cloud-init` to install the package for CentOS or `sudo apt update && sudo apt install -y cloud-init` to install it for Debian or Ubuntu. * For an image based on an AMI, cloud platform verification for the VM instance is disabled in the `cloud-init` settings. See [this guide](custom-image.md#ec2). * The system firewall is configured to only allow the minimum ports required for your applications to run securely and the SSH port (by default, 22 TCP). * The SSH server starts automatically at VM startup. * The services running your application are resilient to VM reboots. * Depending on the [hardware generation](../../concepts/hardware-generations.md) that will be assigned to the new image, the boot disk requires different partition table formats: * `Gen 1.1` and `Gen 1.2`: Use [MBR](https://en.wikipedia.org/wiki/Master_boot_record) partitioning for the boot disk. * `Gen 2`: Use [GPT](https://en.wikipedia.org/wiki/GUID_Partition_Table) partitioning for the boot disk. * The disk is mounted by its UUID rather than by name. * The file system is not encrypted. Supported formats: `Qcow2`, `VMDK`, `RAW`, and `VHD`. For setup instructions, see [Setting up a custom disk image](custom-image.md). ## Upload the image file to Object Storage {#upload-file} Upload your image file to Object Storage and get a shareable link: 1. If you have no [Object Storage bucket](../../../storage/concepts/bucket.md) yet, [create](../../../storage/operations/buckets/create.md) one with restricted access. 1. Upload your image to the bucket via the [management console](../../../storage/operations/objects/upload.md), [AWS CLI](../../../storage/tools/aws-cli.md), or [WinSCP](../../../storage/tools/winscp.md). In Object Storage terminology, your uploaded image will be called an _object_. 1. [Get](../../../storage/operations/objects/link-for-download.md) a signed [link](../../../storage/concepts/pre-signed-urls.md) to download the image from the bucket. Use this link when creating an image in Compute Cloud. ## Creating an image in Compute Cloud {#create-image} Create a new image using the link you got in Object Storage: {% list tabs group=instructions %} - Management console {#console} 1. In the management console, select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create an image. 1. Navigate to **Compute Cloud**. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/layers.svg) **Images**. 1. Click **Upload image**, and in the window that opens: 1. In the **Name** field, enter a name for the image. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. Optionally, in the **Description** field, add a description of the new image. 1. In the **Link to image in Object Storage** field, paste the image file link you previously got in Object Storage. 1. In the **Hardware generation** field, select the hardware generation for the virtual machines created from your image. For more information about the available options, see [Hardware generations](../../concepts/hardware-generations.md). {% note tip %} To use a [UEFI/EFI](https://en.wikipedia.org/wiki/UEFI) bootloader, select the `Gen 2` [hardware generation](../../concepts/hardware-generations.md) when creating your image and Compute Cloud VM instance. For more information about creating a VM instance running on virtualized `Gen 2` hardware, see [this guide](../vm-create/create-gen2-vm.md). To boot from disks larger than 2 TB with the [GUID Partition Table (GPT)](https://en.wikipedia.org/wiki/GUID_Partition_Table) on VM instances running on `Gen 1.1` and `Gen 1.2` hardware, use the [GRUB 2](https://www.gnu.org/software/grub/manual/grub/html_node/BIOS-installation.html) bootloader. {% endnote %} {% note alert %} If you select `Gen 2`, make sure the bootloader in your image supports [UEFI](https://en.wikipedia.org/wiki/UEFI) and [GPT](https://en.wikipedia.org/wiki/GUID_Partition_Table). Otherwise, VMs will not be able to boot the operating system. {% endnote %} 1. To enable image [optimization](../../concepts/image.md#images-optimized-for-deployment) for deployment, enable the **Optimization** option. 1. Click **Upload**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. To create a new image via the link, run the following command: ```bash yc compute image create \ --name \ --source-uri \ --pooled ``` Where: * `--name`: Name to assign to the image. Follow these image naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `--source-uri`: Image link you got in Object Storage. * `--pooled`: Enables image [optimization](../../concepts/image.md#images-optimized-for-deployment) for deployment. This is an optional setting. By default, optimization is disabled. Add a description as required and specify the [family](../../concepts/image.md#family) the image belongs to: ```bash yc compute image create \ --name ubuntu-cosmic \ --description "Ubuntu Server 18.10 (Cosmic Cuttlefish)" \ --family ubuntu \ --source-uri "https://storage.yandexcloud.net/mybucket/cosmic-server-cloudimg-amd64.vmdk" ``` If you know the minimum required size of a [disk](../../concepts/disk.md) to create from this image, specify it in GB: ```bash yc compute image create \ --name big-image \ --min-disk-size 20 \ --source-uri "https://storage.yandexcloud.net/mybucket/cosmic-server-cloudimg-amd64.vmdk" ``` {% note info %} The `min-disk-size` value must be greater than the size of the source data in the image and greater than the size of the virtual disk specified in the image. If you set `min-disk-size` below the allowed minimum, you will get an error and no image will be created. The error message will state the minimum value in bytes, e.g., `Minimal disk size should be greater or equal than 10737418240`. If you omit `min-disk-size`, the minimum value will be used. {% endnote %} If you want to create an image with the `Gen 1.2` VM hardware [generation](../../concepts/hardware-generations.md) assigned: ```bash yc compute image create \ --name gen12-image \ --description "Ubuntu Server Hardware Generation Gen 1.2" \ --hardware-generation-id legacy \ --hardware-features pci_topology=v2 \ --source-uri "https://storage.yandexcloud.net/mybucket/cosmic-server-cloudimg-amd64.vmdk" ``` {% note tip %} To use a [UEFI/EFI](https://en.wikipedia.org/wiki/UEFI) bootloader, select the `Gen 2` [hardware generation](../../concepts/hardware-generations.md) when creating your image and Compute Cloud VM instance. For more information about creating a VM instance running on virtualized `Gen 2` hardware, see [this guide](../vm-create/create-gen2-vm.md). To boot from disks larger than 2 TB with the [GUID Partition Table (GPT)](https://en.wikipedia.org/wiki/GUID_Partition_Table) on VM instances running on `Gen 1.1` and `Gen 1.2` hardware, use the [GRUB 2](https://www.gnu.org/software/grub/manual/grub/html_node/BIOS-installation.html) bootloader. {% endnote %} {% note alert %} If you select `Gen 2`, make sure the bootloader in your image supports [UEFI](https://en.wikipedia.org/wiki/UEFI) and [GPT](https://en.wikipedia.org/wiki/GUID_Partition_Table). Otherwise, VMs will not be able to boot the operating system. {% endnote %} If you want to create an image with the `Gen 2` VM hardware generation assigned: ```bash yc compute image create \ --name gen2-image \ --description "Ubuntu Server Hardware Generation Gen 2" \ --hardware-generation-id generation2 \ --source-uri "https://storage.yandexcloud.net/mybucket/cosmic-server-cloudimg-amd64.vmdk" ``` For more information about the `yc compute image create` command, see the [CLI reference](../../../cli/cli-ref/compute/cli-ref/image/create.md). - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. To create an image: 1. Specify the parameters of the `yandex_compute_image` resource in the configuration file. Here is an example of the configuration file structure: ```hcl resource "yandex_compute_image" "image-1" { name = "" os_type = "LINUX" source_url = "" pooled = "false" hardware_generation { generation2_features {} legacy_features { pci_topology = "PCI_TOPOLOGY_V1|PCI_TOPOLOGY_V2" } } } ``` Where: * `name`: Name to assign to the image. Follow these image naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `source_url`: Image link in Object Storage. * `pooled`: Enables image [optimization](../../concepts/image.md#images-optimized-for-deployment) for deployment. The possible values are: * `true`: Optimization enabled. * `false`: Optimization disabled. This is an optional setting. By default, optimization is disabled. * `hardware_generation`: VM [hardware generation](../../concepts/hardware-generations.md) configuration: {% note tip %} To use a [UEFI/EFI](https://en.wikipedia.org/wiki/UEFI) bootloader, select the `Gen 2` [hardware generation](../../concepts/hardware-generations.md) when creating your image and Compute Cloud VM instance. For more information about creating a VM instance running on virtualized `Gen 2` hardware, see [this guide](../vm-create/create-gen2-vm.md). To boot from disks larger than 2 TB with the [GUID Partition Table (GPT)](https://en.wikipedia.org/wiki/GUID_Partition_Table) on VM instances running on `Gen 1.1` and `Gen 1.2` hardware, use the [GRUB 2](https://www.gnu.org/software/grub/manual/grub/html_node/BIOS-installation.html) bootloader. {% endnote %} {% note alert %} If you select `Gen 2`, make sure the bootloader in your image supports [UEFI](https://en.wikipedia.org/wiki/UEFI) and [GPT](https://en.wikipedia.org/wiki/GUID_Partition_Table). Otherwise, VMs will not be able to boot the operating system. {% endnote %} * `generation2_features`: Parameter that assigns the `Gen 2` hardware generation to the new image. This is an optional setting. You cannot use this parameter together with `legacy_features`. * `legacy_features`: Parameter to assign the `Gen 1.2` hardware generation to the new image. You cannot use this parameter together with `generation2_features`. * `pci_topology`: PCI topology configuration. The possible values are: * `PCI_TOPOLOGY_V1`: Matches the `Gen 1.1` hardware generation. * `PCI_TOPOLOGY_V2`: Matches the `Gen 1.2` hardware generation. The `hardware_generation` configuration section is optional. If it is not specified, `Gen 1.1` will be assigned to the new image. For more information about `yandex_compute_image` properties, see [this Terraform provider guide](../../../terraform/resources/compute_image.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check new resources in the [management console](https://console.yandex.cloud) or using this CLI command: ```bash yc compute image list ``` - API {#api} Create a new image using the [create](../../api-ref/Image/create.md) REST API method for the [Image](../../api-ref/Image/index.md) resource or the [ImageService/Create](../../api-ref/grpc/Image/create.md) gRPC API call. In the request, specify the image link you got in Object Storage. {% note tip %} To use a [UEFI/EFI](https://en.wikipedia.org/wiki/UEFI) bootloader, select the `Gen 2` [hardware generation](../../concepts/hardware-generations.md) when creating your image and Compute Cloud VM instance. For more information about creating a VM instance running on virtualized `Gen 2` hardware, see [this guide](../vm-create/create-gen2-vm.md). To boot from disks larger than 2 TB with the [GUID Partition Table (GPT)](https://en.wikipedia.org/wiki/GUID_Partition_Table) on VM instances running on `Gen 1.1` and `Gen 1.2` hardware, use the [GRUB 2](https://www.gnu.org/software/grub/manual/grub/html_node/BIOS-installation.html) bootloader. {% endnote %} {% note alert %} If you select `Gen 2`, make sure the bootloader in your image supports [UEFI](https://en.wikipedia.org/wiki/UEFI) and [GPT](https://en.wikipedia.org/wiki/GUID_Partition_Table). Otherwise, VMs will not be able to boot the operating system. {% endnote %} By default, the `Gen 1.1` [hardware generation](../../concepts/hardware-generations.md) is assigned to newly created images. To create an image with the `Gen 1.2` hardware generation assigned, provide the following object in the request body: ```json ... "hardwareGeneration": { "legacyFeatures": { "pciTopology": "PCI_TOPOLOGY_V2" } } ... ``` To create an image with the `Gen 2` hardware generation assigned, provide the following object in the request body: ```json ... "hardwareGeneration": { "generation2Features": {} } ... ``` {% endlist %} Once created, the image will get the `CREATING` status. Wait until its status changes to `READY` before using it. ## Deleting the image from Object Storage {#delete-image} If you have successfully created an image, you can [delete the image file](../../../storage/operations/objects/delete.md) from Object Storage. You can also [delete the bucket](../../../storage/operations/buckets/delete.md) if it contains no objects. ## Creating a VM from a pre-built image {#create-vm-from-user-image} You can create a VM with disks from a pre-built image. # Creating a VM from a custom image {% note info %} To create, modify, and edit a [VM](../../concepts/vm.md), you need the `compute.editor` _minimum_ [role](../../security/index.md#compute-editor) for the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder). To create a VM with a licensed image, you will additionally need the `license-manager.viewer` [role](../../../marketplace/security/index.md#license-manager-viewer). To create a VM with a [public IP address](../../../vpc/concepts/address.md#public-addresses), you will additionally need the `vpc.publicAdmin` [role](../../../vpc/security/index.md#vpc-public-admin). {% endnote %} ## Getting started {#before-you-begin} [Prepare and upload](upload.md) an [image](../../concepts/image.md) to Compute Cloud to create a VM from. Make sure the image you upload has the `READY` status. ## Creating a VM from a pre-built image {#create-vm-from-image} {% note info %} [Disks](../../concepts/disk.md), [snapshots](../../concepts/snapshot.md), and [images](../../concepts/image.md) are separate resources that work independently from each other in Compute Cloud. You can create, delete, and manage them separately. Any changes you make to the disk do not affect the snapshot of that disk or the image it was created from. Even if you delete the disk or the VM with the disk, its snapshot and image will remain unaffected. {% endnote %} {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder to create your VM in. 1. Navigate to **Compute Cloud**. 1. In the left-hand panel, select ![image](../../../_assets/console-icons/server.svg) **Virtual machines**. 1. Click **Create virtual machine**. 1. Under **Boot disk image**: * Navigate to the **Custom** tab. * Click **Select** and select **Create** in the window that opens. * In the **Contents** field, select `Image` and then select the image you need from the list below. * Optionally, enable **Additional** in the **Delete along with the virtual machine** field if you need this disk automatically deleted when deleting the VM. * Click **Add disk**. 1. Under **Location**, select the [availability zone](../../../overview/concepts/geo-scope.md) where your VM will reside. 1. Add a [disk](../../concepts/disk.md): * Under **Disks and file storages**, click **Add** * In the window that opens, select **Disk** → `Create new`. * In the **Contents** field, select `Image` and then select the image you need from the list below. * Enter a name for the disk. * Select the [disk type](../../concepts/disk.md#disks_types). * Specify the required disk and block size. * Optionally, enable **Additional** in the **Delete along with the virtual machine** field if you need this disk automatically deleted when deleting the VM. * Click **Add disk**. 1. Optionally, to [encrypt](../../concepts/encryption.md) a boot disk or a secondary disk, under **Disks and file storages**, click ![image](../../../_assets/console-icons/pencil.svg) to the right of the disk name and configure encryption parameters for the disk: * Select **Encrypted disk**. * In the **KMS key** field, select the [key](../../../kms/concepts/key.md) you want to use to encrypt the disk. To [create](../../../kms/operations/key.md#create) a new key, click **Create**. To create an encrypted disk, you need the `kms.keys.user` [role](../../../kms/security/index.md#kms-keys-user) or higher. {% note warning %} You can specify encryption settings only when creating a disk. You cannot disable or change disk encryption. You also cannot enable encryption for an existing disk. {% endnote %} If you deactivate the key used to encrypt a disk, image, or snapshot, access to the data will be suspended until you reactivate the key. {% note alert %} If you destroy the key or its [version](../../../kms/concepts/version.md) used to encrypt a disk, image, or snapshot, you will irrevocably lose access to the data. For details, see [Destroying key version](../../../kms/concepts/version.md#version-distruct). {% endnote %} 1. Optionally, connect a [file storage](../../concepts/filesystem.md): * Under **Disks and file storages**, click **Add**. * In the window that opens, select **File storage** and choose the storage you want to connect from the list. * Click **Add file storage**. 1. Under **Computing resources**, select one of the preset configurations or create a custom one. To create a custom configuration: * Go to the **Custom** tab. * Select a [platform](../../concepts/vm-platforms.md). * Specify the [guaranteed performance](../../concepts/performance-levels.md) and required number of vCPUs, as well as RAM size. * Enable a [software-accelerated network](../../concepts/software-accelerated-network.md) if needed. * Make your VM [preemptible](../../concepts/preemptible-vm.md), if required. 1. Under **Network settings**: * In the **Subnet** field, enter the ID of a subnet in the new VM’s availability zone. Alternatively, select a [cloud network](../../../vpc/concepts/network.md#network) from the list. * Each network must have at least one [subnet](../../../vpc/concepts/network.md#subnet). If your network has no subnets, create one by selecting **Create subnet**. * If there are no networks in the list, click **Create network** to create one: * In the window that opens, specify the network name and select the folder where it will be created. * Optionally, enable the **Create subnets** setting to automatically create subnets in all availability zones. * Click **Create network**. * In the **Public IP address** field, select the IP address assignment method: * `Auto`: To assign a random IP address from the Yandex Cloud IP address pool. In this case, you can enable [DDoS protection](../../../vpc/ddos-protection/index.md) using the option below. * `List`: To select a public IP address from the list of previously reserved static addresses. For more information, see [Converting a dynamic public IP address to static](../../../vpc/operations/set-static-ip.md). * `No address`: Do not assign a public IP address. * Select [relevant security groups](../../../vpc/concepts/security-groups.md): * To connect to a virtual machine over `SSH`, the security group must allow incoming network traffic over `TCP` and `UDP` on port `22`. * To connect to a virtual machine over `RDP`, the security group must allow incoming network traffic over `TCP` and `UDP` on port `3389`. If you leave the field empty, the virtual machine will be automatically assigned the [default security group](../../../vpc/concepts/security-groups.md#default-security-group) allowing connections to the VM over `SSH` and `RDP`. * Expand **Additional** and select a method for assigning internal addresses in the **Internal IPv4 address** field: * `Auto`: To assign a random IP address from the pool of IP addresses available in the selected subnet. * `Manual`: To manually assign a private IP address to the VM. * Enable **DDoS protection**, if required. The option is available if you previously selected the automatic IP assignment method in the public address settings. * Optionally, create records for your VM in the [DNS zone](../../../dns/concepts/dns-zone.md): * Expand **DNS settings for internal addresses** and click **Add record**. * Specify a zone, FQDN, and TTL for the record. When setting the FQDN, you can enable `Detect automatically` for the zone. You can add multiple records to [internal DNS zones](../../../dns/concepts/dns-zone.md). For more information, see [Yandex Cloud DNS integration with Yandex Compute Cloud](../../../dns/concepts/compute-integration.md). * To create another record, click **Add record**. If you want to add another [network interface](../../concepts/network.md) to your VM, click **Add network interface** and repeat the settings from this step for the new interface. You can add up to eight network interfaces to a single VM. 1. Under **Access**: * Select **Access by OS Login** to [connect](../vm-connect/os-login.md) and manage access to the new VM using [OS Login](../../../organization/concepts/os-login.md) in Yandex Identity Hub. With OS Login, you can connect to VMs using SSH keys and SSH certificates via a standard SSH client or the [Yandex Cloud CLI](../../../cli/quickstart.md). OS Login enables rotating the SSH keys used to access VMs, providing the most [secure](../../../security/domains/iaas-checklist.md#vm-security) access option. * If you prefer not to use OS Login, select **SSH key** and specify the following VM access data: * In the **Login** field, enter the username. {% note alert %} Do not use `root` or other [OS-reserved usernames](https://github.com/canonical/subiquity/blob/main/reserved-usernames). To perform operations requiring root privileges, use the `sudo` command. {% endnote %} * In the **SSH key** field, select the SSH key saved in your [organization user](../../../organization/concepts/membership.md) profile. If there are no SSH keys in your profile or you want to add a new key: 1. Click **Add key**. 1. Enter a name for the SSH key. 1. Select one of the following: * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own. * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own. * `Generate key`: Automatically create an SSH key pair. When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home//.ssh` directory. In Windows, unpack the archive to the `C:\Users\/.ssh` directory. You do not need additionally enter the public key in the management console. 1. Click **Add**. The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource. If you want to add multiple users with SSH keys to the VM at the same time, [specify](../../concepts/metadata/sending-metadata.md) these users' data under **Metadata**. You can also use metadata to [install additional software](../vm-create/create-with-cloud-init-scripts.md) on a VM when creating it. In public Linux images provided by Yandex Cloud, the functionality of connecting over SSH using login and password is disabled by default. 1. Optionally, enable the **Backup** option and, in the **Backup policies** field, select or create a [backup policy](../../../backup/concepts/policy.md) to back up your VMs automatically using [Cloud Backup](../../../backup/index.md). To create a new VM with a Cloud Backup connection, your account must have the `backup.user` [role](../../../backup/security/index.md#backup-user) or higher for the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) you are creating the VM in. {% note info %} If your account does not have the `backup.user` role or higher, you can connect the VM to Cloud Backup using a [service account](../../../iam/concepts/users/service-accounts.md) which has that role. To do this, expand the **Additional** section and select the service account under **Service account**. If required, [create](../../../iam/operations/sa/create.md) a new service account and [assign](../../../iam/operations/sa/assign-role-for-sa.md) it the `backup.user` [role](../../../backup/security/index.md#backup-user). {% endnote %} {% note tip %} Installing a Cloud Backup agent is a resource-intensive operation. If you want to use a VM in the minimum possible configuration or, for example, a VM with a [vCPU performance level](../../concepts/performance-levels.md) below 100%, we recommend increasing the VM's resources during the Cloud Backup agent installation. {% endnote %} For more information, see [Connecting Compute Cloud VMs and Yandex BareMetal servers to Cloud Backup](../../../backup/concepts/vm-connection.md). 1. Under **General information**, enter a name for the VM: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. {% note info %} The VM name is used to generate an [internal FQDN](../../concepts/network.md#hostname), which is set only once, when you create the VM. If the internal FQDN is important to you, make sure to choose an appropriate name for your VM. {% endnote %} 1. Under **Additional**: * Optionally, select or create a [service account](../../../iam/concepts/users/service-accounts.md). With a service account, you can flexibly configure access permissions for your resources. * Optionally, enable access to the [serial console](../../concepts/serial-console.md). * Optionally, to configure delivering [Linux metrics](../../../monitoring/operations/unified-agent/linux_metrics.md) and any additional metrics from your apps, enable **Monitoring** under **Agent for delivering metrics** and select: * **Yandex Monitoring**: [Install an agent](../../../monitoring/concepts/data-collection/unified-agent/index.md) to collect additional metrics from VM instances and apps. * **Yandex Managed Service for Prometheus®**: [Install and configure an agent](../../../monitoring/operations/prometheus/ingestion/prometheus-agent.md) to collect additional metrics from VM instances and apps in Prometheus format: * Select or create a workspace to store your metrics. * Optionally, describe the [delivery parameters](../../../monitoring/operations/prometheus/ingestion/prometheus-agent.md) for your custom metrics, in JSON format. * Optionally, under **Placement**, select a VM [placement group](../../concepts/placement-groups.md). 1. Click **Create VM**. The VM will appear in the list. The system automatically assigns an [IP address](../../../vpc/concepts/address.md) and [host name](../../../vpc/concepts/address.md#fqdn) (FQDN) to a VM once it is created. You can monitor the VM status in the serial console or [serial port output](../vm-info/get-serial-port-output.md). - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. View the description of the CLI command to create a VM: ```bash yc compute instance create --help ``` 1. Get a list of images in the default [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder): ```bash yc compute image list ``` Result: ```text +----------------------+-----------------+--------+-------------+--------+ | ID | NAME | FAMILY | PRODUCT IDS | STATUS | +----------------------+-----------------+--------+-------------+--------+ | ... | ... | | | ... | | fd8gkcd3l6ov******** | your-test-image | | | READY | | ... | ... | | | ... | +----------------------+-----------------+--------+-------------+--------+ ``` 1. Select `ID` or `NAME` of the image you need. 1. Select a [subnet](../../../vpc/concepts/network.md#subnet): ```bash yc vpc subnet list ``` Result: ```text +----------------------+---------------------------+----------------------+----------------+-------------------+-----------------+ | ID | NAME | NETWORK ID | ROUTE TABLE ID | ZONE | RANGE | +----------------------+---------------------------+----------------------+----------------+-------------------+-----------------+ | e9bnlm18l70a******** | default-ru-central1-a | enpe3m3fa00u******** | | ru-central1-a | [10.128.0.0/24] | +----------------------+---------------------------+----------------------+----------------+-------------------+-----------------+ ``` 1. Create a VM in the default [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder): ```bash yc compute instance create \ --name \ --zone \ --network-interface subnet-name=,nat-ip-version=ipv4 \ --create-boot-disk name=,size=,image-id=,kms-key-id= \ --ssh-key ``` Where: * `--name`: VM name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. {% note info %} The VM name is used to generate an [internal FQDN](../../concepts/network.md#hostname), which is set only once, when you create the VM. If the internal FQDN is important to you, make sure to choose an appropriate name for your VM. {% endnote %} * `--zone`: [Availability zone](../../../overview/concepts/geo-scope.md) matching the selected subnet. * `--network-interface`: VM [network interface](../../concepts/network.md) settings: * `subnet-name`: Name of the selected subnet. * `nat-ip-version=ipv4`: [Public IP address](../../../vpc/concepts/address.md#public-addresses). To create a VM without a public IP address, omit this parameter. If you want to add multiple [network interfaces](../../concepts/network.md) to your VM, specify the `--network-interface` parameter as many times as you need. You can add up to eight network interfaces to a single VM. * `--create-boot-disk`: VM boot disk settings: * `name`: Boot disk name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `size`: Disk size in GB. * `image-id`: ID of the custom image to create the VM from. Specify the ID of the [uploaded](upload.md) image. * `kms-key-id`: ID of the [KMS symmetric key](../../../kms/concepts/key.md) for creating an encrypted boot disk. This is an optional setting. To create an encrypted disk, you need the `kms.keys.user` [role](../../../kms/security/index.md#kms-keys-user) or higher. {% note warning %} You can specify encryption settings only when creating a disk. You cannot disable or change disk encryption. You also cannot enable encryption for an existing disk. {% endnote %} If you deactivate the key used to encrypt a disk, image, or snapshot, access to the data will be suspended until you reactivate the key. {% note alert %} If you destroy the key or its [version](../../../kms/concepts/version.md) used to encrypt a disk, image, or snapshot, you will irrevocably lose access to the data. For details, see [Destroying key version](../../../kms/concepts/version.md#version-distruct). {% endnote %} * `--ssh-key`: Path to the file with the [public SSH key](../vm-connect/ssh.md#creating-ssh-keys). The VM will automatically create a user named `yc-user` for this key. When creating a VM from a [Yandex Cloud Marketplace](https://yandex.cloud/en/marketplace) public image, make sure to provide an SSH key, as SSH access with a username and password is disabled by default for such images. If you want to add multiple users with SSH keys to your VM at the same time, [specify](../../concepts/metadata/sending-metadata.md) these users' data in the `--metadata-from-file` parameter. When a VM is created, it is assigned an IP address and hostname (FQDN). This data can be used for SSH access. You can make a public IP address static. For more information, see [Making a VM public IP address static](../vm-control/vm-set-static-ip.md). Result: ```text id: fhmue131en37******** folder_id: b1g681qpemb4******** created_at: "2024-03-02T12:58:43Z" name: test-vm-from-image zone_id: ru-central1-a platform_id: standard-v2 resources: memory: "2147483648" cores: "2" core_fraction: "100" status: RUNNING metadata_options: gce_http_endpoint: ENABLED aws_v1_http_endpoint: ENABLED gce_http_token: ENABLED aws_v1_http_token: DISABLED boot_disk: mode: READ_WRITE device_name: fhmn9n1uhutc******** auto_delete: true disk_id: fhmn9n1uhutc******** network_interfaces: - index: "0" mac_address: d0:0d:1e:70:46:17 subnet_id: e9bb9n0v4h17******** primary_v4_address: address: 10.12*.*.** one_to_one_nat: address: 178.154.***.*** ip_version: IPV4 gpu_settings: {} fqdn: fhmue131en37********.auto.internal scheduling_policy: {} network_settings: type: STANDARD placement_policy: {} ``` - Terraform {#tf} If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. To create a VM from a custom image: 1. In the configuration file, describe the resources you want to create: ```hcl resource "yandex_compute_disk" "boot-disk" { name = "" type = "" zone = "" size = "" image_id = "" } resource "yandex_compute_instance" "vm-1" { name = "vm-from-image" allow_stopping_for_update = true platform_id = "standard-v3" zone = "" resources { cores = memory = } boot_disk { disk_id = yandex_compute_disk.boot-disk.id } network_interface { subnet_id = "${yandex_vpc_subnet.subnet-1.id}" nat = true } metadata = { ssh-keys = ":" } } resource "yandex_vpc_network" "network-1" { name = "network1" } resource "yandex_vpc_subnet" "subnet-1" { name = "subnet1" zone = "" network_id = "${yandex_vpc_network.network-1.id}" } ``` Where: * `yandex_compute_disk`: Boot [disk](../../concepts/disk.md) description: * `name`: Disk name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. * `type`: Disk type. * `zone`: [Availability zone](../../../overview/concepts/geo-scope.md) the disk will reside in. * `size`: Disk size, in GB. * `image_id`: ID of the custom image to create the VM from. Specify the ID of the [uploaded](upload.md) image. * `yandex_compute_instance`: VM description. * `name`: VM name. The naming requirements are as follows: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. {% note info %} The VM name is used to generate an [internal FQDN](../../concepts/network.md#hostname), which is set only once, when you create the VM. If the internal FQDN is important to you, make sure to choose an appropriate name for your VM. {% endnote %} * `allow_stopping_for_update`: Permission to stop the VM for updates. Set to `true` if you plan to change your VM's network settings or computing resources using Terraform. The default value is `false`. * `platform_id`: [Platform](../../concepts/vm-platforms.md). * `zone`: Availability zone the VM will reside in. * `resources`: Number of vCPUs and amount of RAM available to the VM. The values must match the selected [platform](../../concepts/vm-platforms.md). * `boot_disk`: Boot disk settings. Specify the disk ID. * `network_interface`: VM [network interface](../../concepts/network.md) settings. Specify the ID of the selected [subnet](../../../vpc/concepts/network.md#subnet). To automatically assign a [public IP address](../../../vpc/concepts/address.md#public-addresses) to the VM, set `nat = true`. If you want to add multiple [network interfaces](../../concepts/network.md) to your VM, specify the `network_interface` section as many times as you need. * `metadata`: In metadata, provide the public key for SSH access to the VM. For more information, see [VM metadata](../../concepts/vm-metadata.md). * `yandex_vpc_network`: Cloud network description. * `yandex_vpc_subnet`: Description of the subnet to connect your VM to. {% note info %} If you already have suitable resources, such as a cloud network and subnet, you do not need to redefine them. Specify their names and IDs in the appropriate parameters. {% endnote %} For more information about the resources you can create with Terraform, see [this provider guide](../../../terraform/index.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. This will create all the resources you need in the specified folder. You can check the new resources and their settings using the [management console](https://console.yandex.cloud). - API {#api} Use the [create](../../api-ref/Instance/create.md) REST API method for the [Instance](../../api-ref/Instance/index.md) resource or the [InstanceService/Create](../../api-ref/grpc/Instance/create.md) gRPC API call. {% endlist %} ## Disabling metadata verification {#disable-metadata-check} If you create a VM from an AMI-based image, `cloud-init` will verify that the VM is running within the Amazon EC2 environment. VMs launched in Yandex Compute Cloud will fail the verification and may run incorrectly. To avoid this, disable metadata verification on your VMs: in the `/etc/cloud/cloud.cfg.d` directory, create a configuration file, e.g., `99-ec2-datasource.cfg`, and add the following code to it: ```yaml #cloud-config datasource: Ec2: strict_id: false ``` #### Useful links {#see-also} * [Setting up a custom disk image](custom-image.md) * [Connecting to a Linux VM over SSH](../vm-connect/ssh.md) For information about the Object Storage pricing, see [Object Storage pricing policy](../../../storage/pricing.md).