How DSALTA integrates with Nebius — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Nebius AI Cloud using read-only IAM access to collect compliance evidence automatically. Data feeds into your Data Library modules.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Nebius tenant. The connection uses a Nebius service account to read tenant user accounts and inventory for identity, access, and asset monitoring.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the Nebius user roster — names, email addresses, active status and creation dates, which appears on your Access page; and your Nebius resources, which appear on your Inventory page. Nebius does not expose a per-user role to this integration, so every member is listed as a User.It calls these Nebius endpoints:
gRPC via @nebius/js-sdk against https://iam.api.nebius.cloud: TenantUserAccountService, TenantUserAccountWithAttributesService, ProjectService, ServiceAccountService, AccessKeyService, InstanceService, DiskService, NetworkService, BucketService, ClusterService
Roles the checks require: the service account in the tenant admins or editors group (needed to read tenant user accounts), plus auditor or viewer on each project (needed to read that project’s inventory and service accounts). Nebius grants access through roles assigned to a tenant, a project or a single resource.Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Nebius environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Nebius card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Nebius. This usually happens if the authorized key was removed from the service account in the Nebius Console, or the service account was deleted or dropped from the admins/editors group. Re-upload the key or restore the group membership, then reconnect.
Data is not syncing
Confirm the service account is still in the tenant admins or editors group — a viewer or auditor cannot read tenant user accounts. Verify the Tenant ID, Service account ID, and Public key ID are correct and that the public key is still present as an authorized key, then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.
Durable, no-expiry connection. DSALTA generates a key for you — create a service account in the Nebius Console, give it read access, upload the key, and paste back three IDs. No CLI required.Before you begin
Tenant admin rights in the Nebius Console (needed to create a service account and upload an authorized key)
The service account must be in the tenant admins or editors group — viewer/auditor cannot read tenant user accounts
Read access on each Nebius project you want covered — add the service account to a group holding the auditor (or viewer) role at the project, not only at the tenant. Nebius assigns roles to a tenant, a project or an individual resource and they do not cascade downwards, so a tenant-only grant leaves the Inventory page empty and makes the two service-account checks report Failed with a missing-permission result. Admin at project level is not required.
You will need:
Field
Where to find it
Example
Tenant ID
Top-left tenant switcher → tenant settings. Starts with “tenant-e00…”.
tenant-e00…
Service account ID
Shown on the service account’s page (ID field). Starts with “serviceaccount-e00…”.
serviceaccount-e00…
Public key ID
Service account → Authorized keys, shown after you upload the key. Starts with “publickey-e00…”.
publickey-e00…
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Nebius, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Integrating Nebius with DSALTA means
DSALTA will use a Nebius service account to read tenant user accounts and inventory for identity, access, and asset monitoring. The connection is durable — it never expires. You’ll need tenant admin rights in Nebius to set it up.What the sync produces: Access/People rows from the tenant user accounts (name and email come from the federated identity attributes — if your tenant cannot expose those, rows fall back to the raw useraccount-… id and email matching to People will not work), and Inventory rows for five resource types per project — Compute VMs, Disks, Networks, Object storage buckets and Kubernetes clusters. Nothing else in the tenant is read.
3
Create the service account & upload the key
Create a service account in the Nebius Console, add it to the admins (or editors) group so DSALTA can read users, then upload the public key below as an authorized key — no CLI needed.Exact console route, as a tenant admin: Administration → IAM → Service accounts → Create entity → Service account (confirm the name, pick the project, Create and continue). Then Administration → IAM → Groups, select admins, Add members, switch to the Service accounts tab and add it. Then open the service account, click Upload authorized key → Attach file, attach the .pem DSALTA generates on this step, and click Upload key — the Public key ID you need next then appears on the service account’s Authorized keys tab, alongside the ID field that is your Service account ID.
Leave the expiration date empty on the Upload key form. Nebius makes it optional, and the “never expires” promise here only holds while the authorized key itself has no expiry — if the key lapses the daily sync fails, and restoring it means Disconnect (which permanently deletes the data and tests collected from Nebius) followed by a fresh connect, because there is no Reconnect button.
4
Enter Nebius IDs
Paste your Tenant ID, Service account ID, and the Public key ID shown in the Console after uploading the key, then click Connect.
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Check the IDs, that the public key was uploaded to this service account, and that the account is in the admins/editors group.The on-screen message is generic — see Connection error messages.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)