cloud-create-project

Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.

535stars41forksUpdated 7/17/2026

#elastic-cloud #provisioning #observability #elasticsearch #serverless #rest-api

Security Assessment

Medium Risk(50/100)

Detected risks:

Secret Exposure([SKILL.md] API_KEY=)

Sensitive File Access([SKILL.md] .env)

Security Score50/100

About cloud-create-project

cloud-create-project creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the Serverless REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. It is used when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project. Day-2 operations such as listing, updating, or deleting projects are handled by the separate cloud-manage-project skill.

The skill requires an EC_API_KEY configured with Admin or Organization owner role, and supports an optional EC_BASE_URL (default https://api.elastic-cloud.com). If EC_API_KEY is not set, it directs the user to run the cloud-setup skill, or to configure variables manually, preferably by creating a .env file in the project root that all cloud/* scripts auto-load. It walks an eight-step creation workflow: verify the API key, present sensible defaults (region default gcp-us-central1) and confirm with the user, optionally list regions, create the project, save credentials and endpoints, wait for initialization, set environment variables, and recommend a scoped API key. Project type is chosen from elasticsearch, observability, or security via --type, and must be confirmed rather than silently defaulted; observability and security accept a --product-tier (default complete, with logs_essentials or essentials options), while elasticsearch uses --optimized-for (default general_purpose, vector only on explicit request). The creation script accepts --wait to poll until the phase moves from initializing to initialized.

Strict security principles govern the skill: it never displays secrets in chat, directs users to the .elastic-credentials file, and treats admin credentials as bootstrap-only for creating a scoped key (the load-credentials command excludes admin by default, with --include-admin used only during the key-creation steps). It also notes that a project's region is permanent, and if credential writes fail it recommends cloud-manage-project's reset-credentials command. It requires Python 3.8+ and network access to api.elastic-cloud.com, and includes scripts/create-project.py plus an api-reference.md. It is aimed at engineers and operators provisioning Elastic Cloud Serverless environments who want confirmation-gated, credential-safe project creation.

FAQ

What are the prerequisites?

Python 3.8+, network access to the Elastic Cloud API (api.elastic-cloud.com), and an EC_API_KEY environment variable set (normally by the cloud-setup skill). Creating projects requires a Cloud API key with Admin or Organization owner role. EC_BASE_URL is optional and defaults to https://api.elastic-cloud.com.

What project types can it create?

Three, selected via --type: elasticsearch (search, analytics, vector workloads), observability (logs, metrics, traces, APM), and security (SIEM, endpoint, cloud security). The skill does not silently default the type; it infers from context, presents the inferred type, and asks for confirmation before proceeding.

How are credentials handled securely?

Secrets are never echoed in chat, thinking, or output. Credentials are written to the .elastic-credentials file, and admin credentials are used only to bootstrap a scoped API key. The load-credentials command excludes admin credentials by default, and --include-admin is used only during the key-creation steps.

How do I wait for a project to be ready?

Pass --wait to the creation script so it polls until the phase changes from initializing to initialized. Only fall back to manually polling the status endpoint if --wait is unavailable.

Can a project's region be changed later?

No. A project's region is permanent and cannot be changed after creation, so the region (default gcp-us-central1) should be confirmed before creating.