Creating SSH keys in Terraform can be an integral part of managing access to your cloud infrastructure. SSH (Secure Shell) keys are a pair of cryptographic keys that provide a secure login mechanism over unsecured networks. Terraform, an Infrastructure as Code (IaC) tool, allows you to manage SSH keys and seamlessly integrate them into your infrastructure configuration.

Generating SSH Keys with Terraform

To generate an SSH key pair in Terraform, you can use the tls_private_key resource, which is part of the TLS provider. This resource helps create a new private key, and Terraform provides a way to access the public key derived from it. Below is a step-by-step guide to generating these keys.

Step 1: Initialize the Terraform Configuration Files

Ensure you have Terraform installed and configured on your system. Begin by creating a new directory for your Terraform files and navigate into it:

mkdir terraform-ssh-keys
cd terraform-ssh-keys

Create a new Terraform configuration file, e.g., main.tf:

touch main.tf

Step 2: Define the Required Providers

Terraform requires the TLS provider for generating the SSH key pair. In your main.tf file, configure the provider block as follows:

1terraform {
2  required_providers {
3    tls = {
4      source  = "hashicorp/tls"
5      version = "~> 3.0"
6    }
7  }
8
9  required_version = ">= 1.0"
10}
11
12provider "tls" {}

Step 3: Create an SSH Key Pair Resource

Define the tls_private_key resource in your main.tf to generate the SSH keys:

1resource "tls_private_key" "example_ssh" {
2  algorithm   = "RSA"
3  rsa_bits    = 2048
4  # ecdsa_curve = "P256" # Uncomment this and comment the line above if you'd prefer ECDSA keys
5}

• algorithm: Specifies the type of the key. Common options include "RSA" and "ECDSA".
• rsa_bits: If using RSA, define the bit length (e.g., 2048).
• ecdsa_curve: If using ECDSA, you can specify the curve, such as "P256", "P384", or "P521".

Step 4: Output the Keys

Terraform can output the generated keys. Define output values in main.tf:

1output "private_key_pem" {
2  description = "The generated private key in PEM format"
3  value       = tls_private_key.example_ssh.private_key_pem
4  sensitive   = true
5}
6
7output "public_key_openssh" {
8  description = "The generated public key in OpenSSH format"
9  value       = tls_private_key.example_ssh.public_key_openssh
10}

• sensitive: Mark the private key as sensitive to prevent it from being displayed directly in the Terraform output logs.

Step 5: Initialize and Apply Terraform

With your configuration ready, initialize Terraform in your current directory:

terraform init

After initialization, apply the configuration to generate the keys:

terraform apply

Terraform will prompt you to confirm the action. Type yes and proceed. After successful execution, Terraform will display the public key.

Step 6: Secure Your SSH Keys

Always handle your SSH keys securely. Store the private key in a secure location and control access to it:

• Never hardcode your private keys in scripts or version control.
• Use tools like AWS Secrets Manager, HashiCorp Vault, or similar services for secure storage.
• Regularly rotate your SSH keys for enhanced security.

Summary

Here's a quick overview of the steps to create an SSH key pair with Terraform:

By using Terraform alongside the TLS provider, you can automate the generation and management of SSH keys, streamlining the deployment of secure and efficient infrastructure.