Allow capturing the public key from ephemeral.tls_private_key into a non-ephemeral/non-WO resource

[ari-becker]

Terraform CLI and Provider Versions

1.11 / 4.1.0

Use Cases or Problem Statement

ephemeral.tls_private_key will produce both a private key and a public key. While it is indeed important for the private key to not be stored in Terraform state, and the ephemerality helps ensure that it is copied into a secret store for further processing, there should be a way to capture the paired public key from ephemeral.tls_private_key and store the public key in a standard resource (e.g. Kubernetes ConfigMap, object bucket, module output, etc.)

Proposal

Something like the following:

ephemeral "tls_private_key" "foo" {
   algorithm = "RSA"
   rsa_bits = 4096
 }

 resource "google_secret_manager_secret_version" "foo" {
   secret_data_wo = ephemeral.tls_private_key.foo.private_key_pem
   secret_data_wo_version = 1
 }

resource "terraform_data" "foo" {
  input_wo = ephemeral.tls_private_key.foo.public_key_pem
  input_wo_version = 1
}

output "public_key" {
  value = terraform_data.foo.output
}

How much impact is this issue causing?

High

Additional Information

hashicorp/terraform#36941

Code of Conduct

• I agree to follow this project's Code of Conduct

[lonegunmanb]

I think we can close this one since @apparentlymart has provided a solution to solve this one here.

[sjgibbs]

Hi. I'm new to Terraform but it seems logical to use the related datasource within the same provider rather than importing another provider, which happens to also be third party.

I would have guessed it would be something like this, but private_key_pem_wo does not exist yet 🙏

ephemeral "tls_private_key" "example" {
  algorithm = "ED25519"
}

data "tls_public_key" "read_pem_example" {
  private_key_pem_wo = tls_private_key.example.private_key_pem
}

resource "aws_key_pair" "pair" {
  key_name   = "ssh-key"
  public_key = data.tls_public_key.read_pem_example.public_key_openssh
}

[jbunting]

Similar issues here. I was surprised to find that there really isn't a good way to store the public key from tls_private_key other than putting it in a secret. It's not a secret.

My thoughts after looking at what's out there -- a general solution for this problem would be nice using terraform_data, but for this very specific situation, a tls_public_key resource would be sufficient (and feel really clean imho).

I'm not entirely sure why tls_public_key is ephemeral in the first place -- it doesn't appear to need to store anything secret in state. I would envision something like this:

variable "version" {
  type = number
}

ephemeral "tls_private_key" "example" {
  algorithm = "ED25519"
}

resource "tls_public_key" "example" {
  private_key_openssh_wo = ephemeral.tls_private_key.example.private_key_openssh
  private_key_version    = local.version
}

output "public_key" {
  value = tls_public_key.public_key_openssh
}

output "private_key" {
  value     = ephemeral.tls_private_key.example.private_key_openssh
  ephemeral = true
}