# Generating and using AWS Key Pairs with Terraform or OpenTofu

> Generation of an Ed25519 Key Pair for SSH Authentication on AWS Linux Machines and Uploading of Key Pairs with Terraform.

- Source: https://www.itwonderlab.com/aws-key-pairs-terraform/
- Published: 2023-12-09
- Updated: 2026-10-05
- Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/)
- Site: IT Wonder Lab (https://www.itwonderlab.com/)

---

## SSH access to EC2 instances requires a key pair

This how-to shows how to create a key pair using `ssh-keygen` and how to upload it to AWS using Terraform / OpenTofu.

Documentation:

-   [AWS documentation in creating key pairs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html).
-   [Customers can now use ED25519 keys for authentication during instance connectivity operations](https://aws.amazon.com/about-aws/whats-new/2021/08/amazon-ec2-customers-ed25519-keys-authentication/).
-   [Terraform aws\_key\_pair](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/key_pair)

Intended usage:

-   Connect using [SSH](https://www.itwonderlab.com/ssh/) protocol to EC2 Linux Instances.
-   Configure EC2 Linux instances using [Ansible](https://www.itwonderlab.com/tutorials/ansible/).

### Prerequisites

The `ssh-keygen` command is part of the OpenSSH authentication key utility and is available on most Linux distributions (see also [Public Key Authentication](https://www.itwonderlab.com/public-key-authentication/)):

```shell
$ ssh-keygen
```

### Generate a Key Pair

There are multiple ways to generate [SSH](https://www.itwonderlab.com/ssh/) Key Pairs depending on the needs.

Command line quick generation without a passphrase

-   `-t ed25519` indicates using the [Edwards-curve Digital Signature Algorithm](#about-edwards-curve-digital-signature-algorithm-ed25519) for key generation.
-   `-N ""` avoids setting a passphrase (a secret used to protect the private key).
-   `-C "Demo IT Wonder Lab SSH User"` is a text description of the Key Pair.
-   `-f ~/keys/ditwl-kp-config-user-ecdsa` specifies where to store the private and public key files.

Generate the Key Pair:

```shell
$ ssh-keygen -t ed25519 -N "" -C "Demo IT Wonder Lab SSH User" -f ~/keys/ditwl-kp-config-user-ecdsa
Generating public/private ed25519 key pair.
Your identification has been saved in /home/jruiz/keys/ditwl-kp-config-user-ecdsa
Your public key has been saved in /home/jruiz/keys/ditwl-kp-config-user-ecdsa.pub
The key fingerprint is:
SHA256:w3ErTHem1Iz3JVvhmL7rx5uVE0b4idJauyTh6mGqirQ Demo IT Wonder Lab SSH User
The key's randomart image is:
+--[ED25519 256]--+
|               . |
|           +  + o|
|        o = *..=o|
|       + = * .== |
|        S.o  oo+ |
|     .  .oo . . +|
|    . .  B =   +.|
|     E  = B o   *|
|   .o... o o  .Bo|
+----[SHA256]-----+
```

Two files are generated in the ~/keys/ directory (~ is the user home directory):

-   `ditwl-kp-config-user-ecdsa`: private key, to use by SSH and Ansible.
-   `ditwl-kp-config-user-ecdsa.pub`: a public key to be distributed to EC2 instances using AWS Console or Terraform.

> [!NOTE]
> Make sure to store the files in a secure location and make a backup.

#### Set the right permission to the file

The private key file should be readable only by its owner. Set the right permission:

```shell
$ chmod 600 $HOME/keys/ditwl_kp_infradmin.pem
```

### Upload the Key to AWS using Terraform

Terraform provides a resource for the creation of Key Pairs. The following example creates a key pair with the name `ditwl-kp-config-user` using the previously created **public** key.

```yaml
# Copyright (C) 2018 - 2023 IT Wonder Lab (https://www.itwonderlab.com)
#
# This software may be modified and distributed under the terms
# of the MIT license.  See the LICENSE file for details.
# -------------------------------- WARNING --------------------------------
# IT Wonder Lab's best practices for infrastructure include modularizing 
# Terraform/OpenTofu configuration. 
# In this example, we define everything in a single file. 
# See other tutorials for best practices at itwonderlab.com
# -------------------------------- WARNING --------------------------------

#Define Terrraform Providers and Backend
terraform {
  required_version = "> 1.5"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
    }
  }
}

#-----------------------------------------
# Default provider: AWS
#-----------------------------------------
provider "aws" {
  shared_credentials_files = ["~/.aws/credentials"]
  profile                  = "ditwl_infradmin"
  region                   = "us-east-1" //See BUG https://github.com/hashicorp/terraform-provider-aws/issues/30488
}

resource "aws_key_pair" "ditwl-kp-config-user" {
  key_name   = "ditwl-kp-config-user"
  public_key = file("~/keys/ditwl-kp-config-user-ecdsa.pub")
}
```

#### Create the Key Pair using Terraform

Init, Plan and Apply the Terraform plan:

```shell
$ tofu apply

OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

OpenTofu will perform the following actions:

  # aws_key_pair.ditwl-kp-config-user will be created
  + resource "aws_key_pair" "ditwl-kp-config-user" {
      + arn             = (known after apply)
      + fingerprint     = (known after apply)
      + id              = (known after apply)
      + key_name        = "ditwl-kp-config-user"
      + key_name_prefix = (known after apply)
      + key_pair_id     = (known after apply)
      + key_type        = (known after apply)
      + public_key      = "ssh-ed25519 AAAAC3NzaC1lZYUA1NTE5AAASIA1CQW/T/mJrP+YWKg+l100+JYlPLNIHBFYRNy3uyZUh Demo IT Wonder Lab SSH User"
      + tags_all        = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  OpenTofu will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_key_pair.ditwl-kp-config-user: Creating...
aws_key_pair.ditwl-kp-config-user: Creation complete after 1s [id=ditwl-kp-config-user]
```

#### Check at the AWS Console

Check that the Key Pair has been created in the AWS Console

Visit EC2 → Key Pairs (under Network & Security)

![Key pairs EC2 us east](https://www.itwonderlab.com/media/tutorials/Terraform-AWS-Key-Pair/Key-pairs-EC2-us-east-1.png)

### Next Steps

Create an [EC2 instance with Terraform, assign the Private Key, and configure with Ansible](https://www.itwonderlab.com/terraform-aws-ansible/).

### About Edwards-curve Digital Signature Algorithm (Ed25519)

Ed25519 is a digital signature algorithm that uses elliptic curve cryptography (ECC) to provide secure authentication and data integrity. It is a popular choice for applications that require high performance and small key sizes, such as:

-   **SSH authentication**: Securely logging into remote servers.
-   **TLS/SSL certificates**: Protecting website traffic.
-   **Code signing**: Ensuring the authenticity of software.
-   **Blockchain transactions**: Verifying the legitimacy of transactions on a blockchain.

Key features of Ed25519:

-   **High performance**: Ed25519 is significantly faster than other commonly used digital signature algorithms, such as RSA and ECDSA. This makes it ideal for applications that require fast signing and verification of messages.
-   **Small key sizes**: Ed25519 uses small public and private keys (32 bytes each), which makes them easier to store and transmit than larger keys used by other algorithms.
-   **High security**: Ed25519 is considered to be a very secure algorithm. It has been carefully designed to resist attacks, and it is based on the well-studied mathematics of elliptic curves.
-   **Open-source**: Ed25519 has an open-source license.

Notes:

-   Ed25519 Key Pairs can not currently be used with AWS Windows machines.
-   Key pairs do not expire.
-   Instead of opening SSH, consider [AWS Systems Manager Session Manager](https://www.itwonderlab.com/aws-systems-manager/), which does not need key pairs or inbound ports.