Create Cloud Providers From The CLI

Use blossom cloud_provider:create to add cloud provider connections from a YAML or JSON payload.

blossom cloud_provider:init

writes a starter Hetzner payload, cloud_provider.yml. ${HETZNER_API_TOKEN} reads the token from your environment; export it or replace it with your credentials:

cloud_provider:
  name: hetzner-production
  provider: hetzner
  credentials:
    api_token: ${HETZNER_API_TOKEN}

blossom cloud_provider:create --data cloud_provider.yml
blossom cloud_provider:create -d '{"cloud_provider":{"name":"hetzner-production","provider":"hetzner","credentials":{"api_token":"..."}}}'

Every payload uses the same cloud_provider resource envelope.

Discover Providers

Run blossom cloud_provider:types to see which providers Blossom supports:

blossom cloud_provider:types
BLOSSOM_OUTPUT=json blossom cloud_provider:types

The JSON output is useful for scripts and tools. It includes provider keys, required credential fields, credential check descriptions, and example payloads.

AWS

cloud_provider:
  name: aws-production
  provider: aws
  credentials:
    access_key_id: AKIA...
    secret_access_key: ...

Blossom checks AWS credentials by listing EC2 regions. The credentials need permission for ec2:DescribeRegions.

Azure

cloud_provider:
  name: azure-production
  provider: azure
  credentials:
    tenant_id: ...
    subscription_id: ...
    client_id: ...
    client_secret: ...

Blossom checks Azure credentials by verifying subscription access. The service principal should have Reader access to the subscription.

GCP

cloud_provider:
  name: gcp-production
  provider: gcp
  credentials:
    type: service_account
    project_id: ...
    private_key: ...
    client_email: ...

Blossom checks GCP credentials by listing compute zones. The service account needs permission for compute.zones.list.

DigitalOcean

cloud_provider:
  name: digitalocean-production
  provider: digitalocean
  credentials:
    token: ...

Blossom checks the token by reading DigitalOcean account information. You can also connect DigitalOcean through browser authorization in the Web UI.

Hetzner

cloud_provider:
  name: hetzner-production
  provider: hetzner
  credentials:
    api_token: ...

Blossom checks Hetzner credentials by listing datacenters. A read-only token is enough for the credential check.

Linode

cloud_provider:
  name: linode-production
  provider: linode
  credentials:
    api_token: ...

Blossom checks Linode credentials by reading account information.

Vultr

cloud_provider:
  name: vultr-production
  provider: vultr
  credentials:
    api_token: ...

Blossom checks Vultr credentials by reading account information.

Check Credentials

After creating a cloud provider, check the saved credentials:

blossom cloud_provider:check --id cloud_provider-100

The command uses the same provider-specific credential check as the Blossom web UI.