File provisioner ssh can't read private_key from parameter store

[ovedanner]

Hi,

I'm trying to create an aws_instance with a few file provisioners. These provisioners have the following form:

provisioner "file" {
    source      = "/path/to/local/file"
    destination = "/path/to/instance/file"

    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = "${data.aws_ssm_parameter.PRIVATE_KEY.value}"
    }
  }

When trying to create (and provision) the instance, terraform throws the following error:

1 error(s) occurred:

* Failed to read key <ACTUAL_PRIVATE_KEY>...

Where it says <ACTUAL_PRIVATE_KEY>, I can see the contents of my private key that reside in the parameter store, so it seems terraform is able to retrieve it. When I put the private key in a file and use the built-in file method to refer to it, everything works fine.

Terraform Version

v0.10.3

Affected Resource(s)

• provisioner (file)

Terraform Configuration Files

provisioner "file" {
    source      = "/path/to/local/file"
    destination = "/path/to/instance/file"

    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = "${data.aws_ssm_parameter.PRIVATE_KEY.value}"
    }
  }

Expected Behavior

The file provisioner should have been able to ssh into the machine

Actual Behavior

Terraform could not read the private key and throws the error:

1 error(s) occurred:

* Failed to read key <ACTUAL_PRIVATE_KEY>...

[coffeepac]

I hit this issue tonight and stumbled across this bug: aws/aws-cli#2596

This may not be a terraform issue but may be an AWS Web Console issue. A workaround is provided in the linked issue.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!