125

I need to spin up a bunch of EC2 boxes for different users. Each user should be sandboxed from all the others, so each EC2 box needs its own SSH key.

What's the best way to accomplish this in Terraform?

Almost all of the instructions I've found want me to manually create an SSH key and paste it into a terraform script.

(Bad) Examples:

Since I need to programmatically generate unique keys for many users, this is impractical.

This doesn't seem like a difficult use case, but I can't find docs on it anywhere.

In a pinch, I could generate Terraform scripts and inject SSH keys on the fly using Bash. But that seems like exactly the kind of thing that Terraform is supposed to do in the first place.

2
  • 4
    Those users would typically supply you with their public keys so you don't need to generate anything. Why would your users want the headache of managing lots of private keys?
    – jarmod
    Apr 10, 2018 at 0:10
  • Long story, but it's definitely a requirement. Part of this terraform build is for a contract where we're also handling user management.
    – Abe
    Apr 10, 2018 at 14:50

5 Answers 5

202

Terraform can generate SSL/SSH private keys using the tls_private_key resource.

So if you wanted to generate SSH keys on the fly you could do something like this:

variable "key_name" {}

resource "tls_private_key" "example" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "generated_key" {
  key_name   = var.key_name
  public_key = tls_private_key.example.public_key_openssh
}

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t2.micro"
  key_name      = aws_key_pair.generated_key.key_name

  tags {
    Name = "HelloWorld"
  }
}

output "private_key" {
  value     = tls_private_key.example.private_key_pem
  sensitive = true
}

This will create an SSH key pair that lives in the Terraform state (it is not written to disk in files other than what might be done for the Terraform state itself when not using remote state), creates an AWS key pair based on the public key and then creates an Ubuntu 20.04 instance where the ubuntu user is accessible with the private key that was generated.

You would then have to extract the private key from the state file and provide that to the users. You could use an output to spit this straight out to stdout when Terraform is applied.

Getting the output from private key is via this command below:

terraform output -raw private_key

Security caveats

I should point out here that passing private keys around is generally a bad idea and you'd be much better having developers create their own key pairs and provide you with the public key that you (or them) can use to generate an AWS key pair (potentially using the aws_key_pair resource as used in the above example) that can then be specified when creating instances.

In general I would only use something like the above way of generating SSH keys for very temporary dev environments that you are controlling so you don't need to pass private keys to anyone. If you do need to pass private keys to people you will need to make sure that you do this in a secure channel and that you make sure the Terraform state (which contains the private key in plain text) is also secured appropriately.

9
  • 1
    the problem is the private key cannot be used with remote_exec Jun 30, 2018 at 0:00
  • @ArchimedesTrajano Why can't the private key be used with remote_exec? Jul 2, 2018 at 6:26
  • @ArchimedesTrajano I just tested and the private key works for me in a remote_exec with aws instance Jul 2, 2018 at 6:45
  • 3
    The original question doesn't require it to then be used as part of an exec so you'd probably be best asking a separate question, linking to this one in it, and explaining why the answer here doesn't fit your particular use case, showing your code and the error you get when you run it.
    – ydaetskcoR
    Jul 2, 2018 at 19:01
  • 2
    This answer only generates a single private key. If you're doing something different then it's probably worth creating a new question showing what you've done and linking back to this one as a reference.
    – ydaetskcoR
    Nov 18, 2019 at 19:45
34

Feb, 2022 Update:

The code below creates myKey to AWS and myKey.pem to your computerand the created myKey and myKey.pem have the same private keys. (I used Terraform v0.15.4)

resource "tls_private_key" "pk" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "kp" {
  key_name   = "myKey"       # Create "myKey" to AWS!!
  public_key = tls_private_key.pk.public_key_openssh

  provisioner "local-exec" { # Create "myKey.pem" to your computer!!
    command = "echo '${tls_private_key.pk.private_key_pem}' > ./myKey.pem"
  }
}

Don't forget to make myKey.pem readable only by you running the code below before ssh to your ec2 instance.

chmod 400 myKey.pem

Otherwise the error below occurs.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0664 for 'myKey.pem' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "myKey.pem": bad permissions
ubuntu@35.72.30.251: Permission denied (publickey).
3
  • I found I need to use trimspace on tls_private_key.bastion.public_key_openssh for aws to accept it
    – mcfedr
    Apr 13, 2022 at 15:55
  • @mcfedr - how did you use trimspace() in the local-exec provisioner ?
    – Saurabh
    Aug 26, 2022 at 5:43
  • @saurabh I don't use local-exec, I just make an output with the key
    – mcfedr
    Aug 27, 2022 at 7:13
15

An extension to the previous answers, doesn't fit in a comment:

To write the generated key to private file with correct permissions:

resource "local_file" "pem_file" {
  filename = pathexpand("~/.ssh/${local.ssh_key_name}.pem")
  file_permission = "600"
  directory_permission = "700"
  sensitive_content = tls_private_key.ssh.private_key_pem
}

However one disadvantage of saving a file like this is that the path will end up in the terraform state. Not a big deal if it's just CI/CD and/or one person running the terraform apply, but if more "appliers", the tfstate will get updated whenever someone different from last apply runs apply. This will create some "update" noise. Not a huge deal but something to be aware of.

An alternative that avoids that is to save the pem file in AWS Secrets Manager, or encrypted in S3, and provide a command to fetch it & create local file.

Update March 2023:

The local_sensitive_file has been available since March 2022. Use that instead:

resource "local_sensitive_file" "pem_file" {
  filename = pathexpand("~/.ssh/${local.ssh_key_name}.pem")
  file_permission = "600"
  directory_permission = "700"
  content = tls_private_key.ssh.private_key_pem
}

Thanks @kangkyud for pointing out how this post could be improved!

2
9

Adding to Kai's answer:

variable "generated_key_name" {
  type        = string
  default     = "terraform-key-pair"
  description = "Key-pair generated by Terraform"
}

resource "tls_private_key" "dev_key" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "generated_key" {
  key_name   = var.generated_key_name
  public_key = tls_private_key.dev_key.public_key_openssh

  provisioner "local-exec" {    # Generate "terraform-key-pair.pem" in current directory
    command = <<-EOT
      echo '${tls_private_key.dev_key.private_key_pem}' > ./'${var.generated_key_name}'.pem
      chmod 400 ./'${var.generated_key_name}'.pem
    EOT
  }

}

1

you must add this along with @ydaetskcoR answer

output "ssh_key" {
  description = "ssh key generated by terraform"
  value       = tls_private_key.asg_lc_key.private_key_pem
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.