Answers: <h1>Update</h1>
  <p>Oops, <strong>Don't do this</strong>. It was pointed out to me that this was wholly insecure as <code>curl http://169.254.169.254/latest/user-data</code> will show you any unprivileged user the private keys. The data gets saved as <code>/run/cloud-init/instance-data.json</code></p>
  <h1>Original post</h1>
  <p>There is no module to make this easier, and there is no argument under <code>system_info</code> (how you add and configure the user) to ease the ability to configure the user's SSH keys. The way I went about this was adding something like this in my <code>main.tf</code> to populate the variable <code>ssh_keys_user</code></p>
  <pre class="lang-json prettyprint-override"><code>ssh_keys_user = {
    write_files = [
      {
        path        = &quot;/home/ecarroll/.ssh/id_rsa&quot;
        content     = file(&quot;./ssh/user/cp-terraform-user-id_rsa&quot;)
        owner       = &quot;ecarroll:ecarroll&quot;
        permissions = &quot;0600&quot;
        defer       = true
      },
      {
        path        = &quot;/home/ecarroll/.ssh/id_rsa.pub&quot;
        content     = file(&quot;./ssh/user/cp-terraform-user-id_rsa.pub&quot;)
        owner       = &quot;ecarroll:ecarroll&quot;
        permissions = &quot;0644&quot;
        defer       = true
      },
      {
        path        = &quot;/home/ecarroll/.ssh/id_ecdsa&quot;
        content     = file(&quot;./ssh/user/cp-terraform-user-id_ecdsa&quot;)
        owner       = &quot;ecarroll:ecarroll&quot;
        permissions = &quot;0600&quot;
        defer       = true
      },
      {
        path        = &quot;/home/ecarroll/.ssh/id_ecdsa.pub&quot;
        content     = file(&quot;./ssh/user/cp-terraform-user-id_ecdsa.pub&quot;)
        owner       = &quot;ecarroll:ecarroll&quot;
        permissions = &quot;0644&quot;
        defer       = true
      },
      {
        path        = &quot;/home/ecarroll/.ssh/id_ed25519&quot;
        content     = file(&quot;./ssh/user/cp-terraform-user-id_ed25519&quot;)
        owner       = &quot;ecarroll:ecarroll&quot;
        permissions = &quot;0600&quot;
        defer       = true
      },
      {
        path        = &quot;/home/ecarroll/.ssh/id_ed25519.pub&quot;
        content     = file(&quot;./ssh/user/cp-terraform-user-id_ed25519.pub&quot;)
        owner       = &quot;ecarroll:ecarroll&quot;
        permissions = &quot;0644&quot;
        defer       = true
      }
    ]
  }
  </code></pre>
  <p>Then what I did was wired it into my cloud-init like this,</p>
  <pre class="lang-yaml prettyprint-override"><code>write_files:
  ${ yamlencode( ssh_keys_user.write_files ) }
  </code></pre>
  <p>I generated these files with a Makefile like this,</p>
  <pre><code>user/cp-terraform-user-id_ecdsa:
          -mkdir user 2&gt; /dev/null;
          ssh-keygen -C &quot;User key for SSH authentication to repos&quot; -N &quot;&quot; -b 521 -t ecdsa -f &quot;$@&quot;;
          touch &quot;$@&quot;;
  
  user/cp-terraform-user-id_ed25519:
          -mkdir user 2&gt; /dev/null;
          ssh-keygen -C &quot;User key for SSH authentication to repos&quot; -N &quot;&quot; -t ed25519 -f &quot;$@&quot;;
          touch &quot;$@&quot;;
  
  user/cp-terraform-user-id_rsa:
          -mkdir user 2&gt; /dev/null;
          ssh-keygen -C &quot;User key for SSH authentication to repos&quot; -N &quot;&quot; -b 4096 -t rsa -f &quot;$@&quot;;
          touch &quot;$@&quot;;
  </code></pre>
  <p>This works fine. Then I just added the <code>.pub</code> files to BitBucket and GitLab.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-03-26T18:57:03.613Z
Answers: 2022-06-13T17:23:21.250Z
Answers: 2022-06-13T17:23:21.250Z
Answers: Evan Carroll
Body: <p>I have a user that needs to authenticate against a company source repository when using <code>git clone</code>. To set this up for the user I need to specify a users private key (not the host private key in <code>/etc</code>). Is there a method to do this?</p>
  <p>The user it configured with <a href="https://cloudinit.readthedocs.io/en/latest/topics/examples.html?highlight=system_info#including-users-and-groups" rel="nofollow noreferrer"><code>system_info</code> in cloud-init</a>, which doesn't have a mechanism to install the user's private key.</p>
  <p>Note: Let's say you're provisioning a a new machine and adding a user bob on it. How do you install a private key for a bob such that he can authenticate with something using ssh?</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-03-25T08:33:50.080Z
Comments: there are many ways to do this, but it's hard to answer this question without knowing the constraints. Can you give some more context to help give a more appropriate answer?
Comments: Bruce Becker
Comments: CC BY-SA 4.0
Comments: 2022-03-26T18:58:15.250Z
Comments: I've self-answered this, as promised. ;) That was what I was looking for.
Comments: Evan Carroll
Tags: <terraform><ssh><terraform-module><cloud-init>
Title: Is there a way to install a private key for a user with cloud-init?
UserDisplayName: Evan Carroll
ThreadText: # Is there a way to install a private key for a user with cloud-init?
  
  (Asked by: username_0 on 2022-03-18)
  
  I have a user that needs to authenticate against a company source repository when using `git clone`. To set this up for the user I need to specify a users private key (not the host private key in `/etc`). Is there a method to do this?
  
  The user it configured with [`system_info` in cloud-init](https://cloudinit.readthedocs.io/en/latest/topics/examples.html?highlight=system_info#including-users-and-groups), which doesn't have a mechanism to install the user's private key.
  
  Note: Let's say you're provisioning a a new machine and adding a user bob on it. How do you install a private key for a bob such that he can authenticate with something using ssh?
  
  **Tags:** terraform, ssh, terraform-module, cloud-init
  
  > **Comments:**
  > **username_1**: there are many ways to do this, but it's hard to answer this question without knowing the constraints. Can you give some more context to help give a more appropriate answer?  
  > **username_0**: I've self-answered this, as promised. ;) That was what I was looking for.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-03-26. Score: 0 | Accepted answer
  
  # Update
  
  Oops, **Don't do this**. It was pointed out to me that this was wholly insecure as `curl http://169.254.169.254/latest/user-data` will show you any unprivileged user the private keys. The data gets saved as `/run/cloud-init/instance-data.json`
  
  # Original post
  
  There is no module to make this easier, and there is no argument under `system_info` (how you add and configure the user) to ease the ability to configure the user's SSH keys. The way I went about this was adding something like this in my `main.tf` to populate the variable `ssh_keys_user`
  
  ```json
  ssh_keys_user = {
    write_files = [
      {
        path        = "/home/ecarroll/.ssh/id_rsa"
        content     = file("./ssh/user/cp-terraform-user-id_rsa")
        owner       = "ecarroll:ecarroll"
        permissions = "0600"
        defer       = true
      },
      {
        path        = "/home/ecarroll/.ssh/id_rsa.pub"
        content     = file("./ssh/user/cp-terraform-user-id_rsa.pub")
        owner       = "ecarroll:ecarroll"
        permissions = "0644"
        defer       = true
      },
      {
        path        = "/home/ecarroll/.ssh/id_ecdsa"
        content     = file("./ssh/user/cp-terraform-user-id_ecdsa")
        owner       = "ecarroll:ecarroll"
        permissions = "0600"
        defer       = true
      },
      {
        path        = "/home/ecarroll/.ssh/id_ecdsa.pub"
        content     = file("./ssh/user/cp-terraform-user-id_ecdsa.pub")
        owner       = "ecarroll:ecarroll"
        permissions = "0644"
        defer       = true
      },
      {
        path        = "/home/ecarroll/.ssh/id_ed25519"
        content     = file("./ssh/user/cp-terraform-user-id_ed25519")
        owner       = "ecarroll:ecarroll"
        permissions = "0600"
        defer       = true
      },
      {
        path        = "/home/ecarroll/.ssh/id_ed25519.pub"
        content     = file("./ssh/user/cp-terraform-user-id_ed25519.pub")
        owner       = "ecarroll:ecarroll"
        permissions = "0644"
        defer       = true
      }
    ]
  }
  
  ```
  
  Then what I did was wired it into my cloud-init like this,
  
  ```yaml
  write_files:
  ${ yamlencode( ssh_keys_user.write_files ) }
  
  ```
  
  I generated these files with a Makefile like this,
  
  ```
  user/cp-terraform-user-id_ecdsa:
          -mkdir user 2> /dev/null;
          ssh-keygen -C "User key for SSH authentication to repos" -N "" -b 521 -t ecdsa -f "$@";
          touch "$@";
  
  user/cp-terraform-user-id_ed25519:
          -mkdir user 2> /dev/null;
          ssh-keygen -C "User key for SSH authentication to repos" -N "" -t ed25519 -f "$@";
          touch "$@";
  
  user/cp-terraform-user-id_rsa:
          -mkdir user 2> /dev/null;
          ssh-keygen -C "User key for SSH authentication to repos" -N "" -b 4096 -t rsa -f "$@";
          touch "$@";
  
  ```
  
  This works fine. Then I just added the `.pub` files to BitBucket and GitLab.
  
  
  ---
  
  