Terraform aws_key_pair creates weird key

Question

I've been researching and testing deploying stuff with terraform, aws secretsmanager and basic ec2 instances.

I got it working. Well, the instance comes up, keys are created, and a remote-exec using said key, works!

However, the key, if I output it, looks like this:

-----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIJffzvvCaUzFEVKYapZh4jjUfF1O3hnjrT6jVT/M9VsX -----END PRIVATE KEY----- 

And ssh refuses to use it. I can't convert it to anything else using ssh-keygen, either.

Yet, it seems to work just fine with my remote-exec:

resource "tls_private_key" "pk" { algorithm = "ED25519" } resource "aws_key_pair" "pgx" { key_name = "pgx" public_key = tls_private_key.pk.public_key_openssh provisioner "local-exec" { command = "echo '${tls_private_key.pk.private_key_pem}' > /home/terraform/.ssh/pgx-private-key.pem" } } resource "aws_instance" "pgx_dev" { ami = "ami-1234" instance_type = "t2.micro" key_name = aws_key_pair.pgx.key_name security_groups = [ "pgx-internal" ] provisioner "remote-exec" { connection { type = "ssh" user = "ubuntu" private_key = tls_private_key.pk.private_key_pem host = "${self.private_ip}" } inline = [ "ls -la" ] } } 

Result:

aws_instance.pgx_dev (remote-exec): Connected! aws_instance.pgx_dev (remote-exec): total 28 ...

If I look at the key in secretsmanager directly, I see the same thing. The file produced by local-exec, same thing.

Yet ssh clearly says: 'Load key "pgx-private-key.pem": invalid format'

What am I missing here?

Answer 1

The solution was to use private_key_openssh instead of private_key_pem in terraform. That produces usable keys for ssh.