How do I import an existing SSH public key file with this Terraform module?

Set the ssh_public_key_file input to the filename and ssh_public_key_path to the directory, then disable generate_ssh_key. The module will read and register the key in AWS without generating a new one.

Can terraform-aws-key-pair be used for services other than EC2, like ECS or RDS?

Primarily designed for EC2 key pairs, it's less useful for non-EC2 services since AWS Key Pair resources are EC2-specific. For other services, consider AWS Secrets Manager or IAM roles instead.

terraform-aws-key-pair vs. using AWS CLI to manage key pairs: what are the trade-offs?

This module automates key management within Terraform for consistency and auditability, while AWS CLI is manual and script-based. Choose the module for infrastructure-as-code workflows, but it adds Terraform complexity.

How to configure the module to store private keys in AWS SSM Parameter Store securely?

Set ssm_parameter_enabled to true and specify ssm_parameter_path_prefix. Ensure IAM permissions allow SSM access, and the private key will be stored encrypted, as noted in the README's secure storage options.

What happens to the SSH keys when I run terraform destroy?

The AWS Key Pair resource is deleted, but locally generated key files may persist unless managed externally. SSM-stored keys remain unless explicitly configured for deletion, requiring manual cleanup.

How can I use the output key name in another Terraform module for an EC2 instance?

Reference the key_name output variable in your EC2 module or resource, e.g., key_name = module.ssh_key_pair.key_name, to associate the generated key with instances declaratively.

Open-Awesome

terraform-aws-key-pair

Apache-2.0HCL0.20.0

A Terraform module to generate or import SSH key pairs and manage them in AWS.

Visit Website GitHub

153 stars71 forks0 contributors

What is terraform-aws-key-pair?

terraform-aws-key-pair is a Terraform module that automates the generation or import of SSH key pairs and their management within AWS. It solves the problem of manually creating and managing SSH keys for AWS resources by providing a declarative way to handle key lifecycle, including creation, storage in SSM Parameter Store, and registration as an AWS Key Pair.

Target Audience

DevOps engineers, SREs, and cloud infrastructure teams using Terraform to manage AWS infrastructure who need a consistent, automated way to handle SSH keys for EC2 instances or other services.

Value Proposition

Developers choose this module because it encapsulates best practices for SSH key management in AWS, reduces manual steps and potential errors, integrates seamlessly with Terraform workflows, and offers secure storage options like SSM Parameter Store.

Overview

Terraform Module to Automatically Generate SSH Key Pairs (Public/Private Keys)

Use Cases

Best For

Automating SSH key creation for new EC2 instances in Terraform
Managing existing SSH public keys within AWS using infrastructure-as-code
Securely storing private keys in AWS Systems Manager Parameter Store
Ensuring consistent SSH key management across multiple Terraform projects or teams
Building reusable Terraform modules that require SSH key provisioning
Implementing secure, auditable access patterns for AWS resources

Not Ideal For

Teams managing multi-cloud infrastructure where AWS is not the primary cloud provider
Organizations with strict compliance requirements mandating SSH key storage in hardware security modules (HSMs) or third-party vaults like HashiCorp Vault
Projects using serverless architectures or managed container services that don't require EC2 instances and SSH access

Pros & Cons

Pros

Automated Key Generation

Creates new RSA SSH key pairs on-the-fly when configured, eliminating manual steps and reducing human error in key creation.

Secure SSM Integration

Optionally stores private keys in AWS Systems Manager Parameter Store, providing encrypted, managed secret storage as highlighted in the README's secure storage options.

Flexible Import Support

Accommodates existing workflows by allowing import of pre-existing SSH public key files, as shown in the input variables for ssh_public_key_file.

Terraform Native Outputs

Provides key names, filenames, and contents as Terraform outputs, enabling seamless integration with other modules like EC2 instance configurations.

Cons

Cloud Posse Dependency

Relies on Cloud Posse's label module for resource naming, which adds external dependency and may require familiarity with their conventions, as seen in the modules section.

Limited Algorithm Flexibility

Defaults to RSA algorithm with ssh_key_algorithm input, and the README doesn't mention support for modern alternatives like Ed25519, potentially limiting cryptographic choices.

SSM Cost Overhead

Enabling SSM parameter storage incurs additional AWS costs and requires careful IAM permission setup, which might not be justified for small-scale or cost-sensitive projects.

Frequently Asked Questions

Related Projects

terraform-aws-eks

Terraform module to create Amazon Elastic Kubernetes (EKS) resources 🇺🇦

Stars5,003

Forks4,409

Last commit24 days ago

terraform-aws-vpc

Terraform module to create AWS VPC resources 🇺🇦

Stars3,260

Forks4,626

Last commit10 days ago

stack

A set of Terraform modules for configuring production infrastructure with AWS

Stars2,087

Forks410

Last commit3 years ago

typhoon

Minimal and free Kubernetes distribution with Terraform

Stars2,052

Forks324

Last commit8 days ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub