<h1>Update</h1>
<p>Oops, <strong>Don't do this</strong>. It was pointed out to me that this was wholly insecure as <code>curl http://169.254.169.254/latest/user-data</code> will show you any unprivileged user the private keys. The data gets saved as <code>/run/cloud-init/instance-data.json</code></p>
<h1>Original post</h1>
<p>There is no module to make this easier, and there is no argument under <code>system_info</code> (how you add and configure the user) to ease the ability to configure the user's SSH keys. The way I went about this was adding something like this in my <code>main.tf</code> to populate the variable <code>ssh_keys_user</code></p>
<pre class="lang-json prettyprint-override"><code>ssh_keys_user = {
  write_files = [
    {
      path        = &quot;/home/ecarroll/.ssh/id_rsa&quot;
      content     = file(&quot;./ssh/user/cp-terraform-user-id_rsa&quot;)
      owner       = &quot;ecarroll:ecarroll&quot;
      permissions = &quot;0600&quot;
      defer       = true
    },
    {
      path        = &quot;/home/ecarroll/.ssh/id_rsa.pub&quot;
      content     = file(&quot;./ssh/user/cp-terraform-user-id_rsa.pub&quot;)
      owner       = &quot;ecarroll:ecarroll&quot;
      permissions = &quot;0644&quot;
      defer       = true
    },
    {
      path        = &quot;/home/ecarroll/.ssh/id_ecdsa&quot;
      content     = file(&quot;./ssh/user/cp-terraform-user-id_ecdsa&quot;)
      owner       = &quot;ecarroll:ecarroll&quot;
      permissions = &quot;0600&quot;
      defer       = true
    },
    {
      path        = &quot;/home/ecarroll/.ssh/id_ecdsa.pub&quot;
      content     = file(&quot;./ssh/user/cp-terraform-user-id_ecdsa.pub&quot;)
      owner       = &quot;ecarroll:ecarroll&quot;
      permissions = &quot;0644&quot;
      defer       = true
    },
    {
      path        = &quot;/home/ecarroll/.ssh/id_ed25519&quot;
      content     = file(&quot;./ssh/user/cp-terraform-user-id_ed25519&quot;)
      owner       = &quot;ecarroll:ecarroll&quot;
      permissions = &quot;0600&quot;
      defer       = true
    },
    {
      path        = &quot;/home/ecarroll/.ssh/id_ed25519.pub&quot;
      content     = file(&quot;./ssh/user/cp-terraform-user-id_ed25519.pub&quot;)
      owner       = &quot;ecarroll:ecarroll&quot;
      permissions = &quot;0644&quot;
      defer       = true
    }
  ]
}
</code></pre>
<p>Then what I did was wired it into my cloud-init like this,</p>
<pre class="lang-yaml prettyprint-override"><code>write_files:
${ yamlencode( ssh_keys_user.write_files ) }
</code></pre>
<p>I generated these files with a Makefile like this,</p>
<pre><code>user/cp-terraform-user-id_ecdsa:
        -mkdir user 2&gt; /dev/null;
        ssh-keygen -C &quot;User key for SSH authentication to repos&quot; -N &quot;&quot; -b 521 -t ecdsa -f &quot;$@&quot;;
        touch &quot;$@&quot;;

user/cp-terraform-user-id_ed25519:
        -mkdir user 2&gt; /dev/null;
        ssh-keygen -C &quot;User key for SSH authentication to repos&quot; -N &quot;&quot; -t ed25519 -f &quot;$@&quot;;
        touch &quot;$@&quot;;

user/cp-terraform-user-id_rsa:
        -mkdir user 2&gt; /dev/null;
        ssh-keygen -C &quot;User key for SSH authentication to repos&quot; -N &quot;&quot; -b 4096 -t rsa -f &quot;$@&quot;;
        touch &quot;$@&quot;;
</code></pre>
<p>This works fine. Then I just added the <code>.pub</code> files to BitBucket and GitLab.</p>

CC BY-SA 4.0
2022-03-26T18:57:03.613Z
2022-06-13T17:23:21.250Z
2022-06-13T17:23:21.250Z
Evan Carroll
<p>I have a user that needs to authenticate against a company source repository when using <code>git clone</code>. To set this up for the user I need to specify a users private key (not the host private key in <code>/etc</code>). Is there a method to do this?</p>
<p>The user it configured with <a href="https://cloudinit.readthedocs.io/en/latest/topics/examples.html?highlight=system_info#including-users-and-groups" rel="nofollow noreferrer"><code>system_info</code> in cloud-init</a>, which doesn't have a mechanism to install the user's private key.</p>
<p>Note: Let's say you're provisioning a a new machine and adding a user bob on it. How do you install a private key for a bob such that he can authenticate with something using ssh?</p>

CC BY-SA 4.0
2022-03-25T08:33:50.080Z
there are many ways to do this, but it's hard to answer this question without knowing the constraints. Can you give some more context to help give a more appropriate answer?
Bruce Becker
CC BY-SA 4.0
2022-03-26T18:58:15.250Z
I've self-answered this, as promised. ;) That was what I was looking for.
Evan Carroll
<terraform><ssh><terraform-module><cloud-init>
Is there a way to install a private key for a user with cloud-init?
Evan Carroll
# Is there a way to install a private key for a user with cloud-init?

(Asked by: username_0 on 2022-03-18)

I have a user that needs to authenticate against a company source repository when using `git clone`. To set this up for the user I need to specify a users private key (not the host private key in `/etc`). Is there a method to do this?

The user it configured with [`system_info` in cloud-init](https://cloudinit.readthedocs.io/en/latest/topics/examples.html?highlight=system_info#including-users-and-groups), which doesn't have a mechanism to install the user's private key.

Note: Let's say you're provisioning a a new machine and adding a user bob on it. How do you install a private key for a bob such that he can authenticate with something using ssh?

**Tags:** terraform, ssh, terraform-module, cloud-init

> **Comments:**
> **username_1**: there are many ways to do this, but it's hard to answer this question without knowing the constraints. Can you give some more context to help give a more appropriate answer?  
> **username_0**: I've self-answered this, as promised. ;) That was what I was looking for.  

---

## 1 answers

### Answer by username_0 on 2022-03-26. Score: 0 | Accepted answer

Update
Oops, Don't do this. It was pointed out to me that this was wholly insecure as curl http://169.254.169.254/latest/user-data will show you any unprivileged user the private keys. The data gets saved as /run/cloud-init/instance-data.json
Original post
There is no module to make this easier, and there is no argument under system_info (how you add and configure the user) to ease the ability to configure the user's SSH keys. The way I went about this was adding something like this in my main.tf to populate the variable ssh_keys_user
ssh_keys_user = {
  write_files = [
    {
      path        = "/home/ecarroll/.ssh/id_rsa"
      content     = file("./ssh/user/cp-terraform-user-id_rsa")
      owner       = "ecarroll:ecarroll"
      permissions = "0600"
      defer       = true
    },
    {
      path        = "/home/ecarroll/.ssh/id_rsa.pub"
      content     = file("./ssh/user/cp-terraform-user-id_rsa.pub")
      owner       = "ecarroll:ecarroll"
      permissions = "0644"
      defer       = true
    },
    {
      path        = "/home/ecarroll/.ssh/id_ecdsa"
      content     = file("./ssh/user/cp-terraform-user-id_ecdsa")
      owner       = "ecarroll:ecarroll"
      permissions = "0600"
      defer       = true
    },
    {
      path        = "/home/ecarroll/.ssh/id_ecdsa.pub"
      content     = file("./ssh/user/cp-terraform-user-id_ecdsa.pub")
      owner       = "ecarroll:ecarroll"
      permissions = "0644"
      defer       = true
    },
    {
      path        = "/home/ecarroll/.ssh/id_ed25519"
      content     = file("./ssh/user/cp-terraform-user-id_ed25519")
      owner       = "ecarroll:ecarroll"
      permissions = "0600"
      defer       = true
    },
    {
      path        = "/home/ecarroll/.ssh/id_ed25519.pub"
      content     = file("./ssh/user/cp-terraform-user-id_ed25519.pub")
      owner       = "ecarroll:ecarroll"
      permissions = "0644"
      defer       = true
    }
  ]
}

Then what I did was wired it into my cloud-init like this,
write_files:
${ yamlencode( ssh_keys_user.write_files ) }

I generated these files with a Makefile like this,
user/cp-terraform-user-id_ecdsa:
        -mkdir user 2> /dev/null;
        ssh-keygen -C "User key for SSH authentication to repos" -N "" -b 521 -t ecdsa -f "$@";
        touch "$@";

user/cp-terraform-user-id_ed25519:
        -mkdir user 2> /dev/null;
        ssh-keygen -C "User key for SSH authentication to repos" -N "" -t ed25519 -f "$@";
        touch "$@";

user/cp-terraform-user-id_rsa:
        -mkdir user 2> /dev/null;
        ssh-keygen -C "User key for SSH authentication to repos" -N "" -b 4096 -t rsa -f "$@";
        touch "$@";

This works fine. Then I just added the .pub files to BitBucket and GitLab.


---

