Cloud account guides for CTL¶

These guides show how to onboard cloud accounts with omnistrate-ctl for both hosted plans and customer-managed BYOA plans.

Note

The examples below use omnistrate-ctl. If you use the shorter omctl alias locally, replace the command name directly.

Hosted vs BYOA¶

Hosted plans run in an account that you operate. Start with omnistrate-ctl account create.
BYOA plans run in an account owned by the customer or by a customer-specific deployment boundary. Start with omnistrate-ctl account customer create.
Deployments use omnistrate-ctl instance create. BYOA plans additionally require --customer-account-id.

Provider guide matrix¶

Provider	Hosted account flow	BYOA account flow	Region enablement model	Guide
AWS	`account create` + CloudFormation/Terraform bootstrap	`account customer create` + customer bootstrap	Region chosen at deployment time	AWS
GCP	`account create` + Cloud Shell bootstrap	`account customer create` + customer bootstrap	Region chosen at deployment time	GCP
Azure	`account create` + Azure Cloud Shell bootstrap	`account customer create` + customer bootstrap	Region chosen at deployment time	Azure
Nebius	`account create` + binding verification	`account customer create` + binding verification	Ready bindings determine eligible regions	Nebius

Shared lifecycle commands¶

Use these commands across all providers:

# Inspect a hosted account config
omnistrate-ctl account describe <account-name-or-id>

# Rename an existing hosted account config or replace Nebius bindings
omnistrate-ctl account update <account-name-or-id> [flags]

# List customer BYOA onboarding instances
omnistrate-ctl account customer list [flags]

# Inspect a customer BYOA onboarding instance
omnistrate-ctl account customer describe <instance-id>

# Update a customer BYOA onboarding instance or its backing account config
omnistrate-ctl account customer update <instance-id> [flags]

# Delete a customer BYOA onboarding instance
omnistrate-ctl account customer delete <instance-id>

For production environments, omnistrate-ctl account customer create uses the calling user's subscription by default. Override that with --subscription-id or --customer-email only when you need to onboard on behalf of a different subscription.

Before you start¶

Install the CLI and log in first. See Installing CLI.
Review the generic Account Onboarding page for the responsibility model and offboarding rules.
Review BYOC Cloud Accounts for operational guidance after onboarding.
For BYOA plans, make sure the target service plan is actually configured as BYOA before using --customer-account-id during deployment creation.

Nebius-specific difference¶

Nebius is the only provider in this guide set that uses bindings inside the account config. A binding is the combination of:

a Nebius project,
a Nebius service account,
a public key ID, and
the matching private key PEM.

Each ready binding enables one Nebius region for deployment. Adding another region means adding another binding and replacing the full binding file during an update.