Terraform CLI and Provider Versions
Terraform v1.7.5
Use Cases or Problem Statement
Many workflows and security policies require storing private keys encrypted in PEM format (e.g., -----BEGIN ENCRYPTED PRIVATE KEY-----).
Today, there is no built-in function or provider resource in Terraform that can accept an encrypted PEM and return a decrypted private key.
This creates multiple challenges:
-
Users must pre-decrypt the key outside of Terraform (e.g., openssl rsa -in encrypted.pem -out decrypted.pem).
-
Automating secure workflows (for example, pipelines that provision resources requiring unencrypted keys) requires either:
-
custom external data sources shelling out to OpenSSL, or
-
storing decrypted keys in plaintext (undesirable).
This problem applies to any resource that consumes unencrypted private keys, not just AWS resources.
Having a native way to decrypt a PEM-encoded key directly in Terraform would enable secure, end-to-end workflows without manual steps or brittle external scripts.
Proposal
Introduce a Terraform built-in function (or a resource in the tls provider) to decrypt an encrypted PEM private key.
Example function syntax:
locals {
decrypted_key = pem_decrypt(
encrypted_pem = file("${path.module}/encrypted-key.pem"),
passphrase = var.key_passphrase
)
}
This function would return a decrypted PEM string.
Alternatively, this could be provided via the tls provider as a tls_private_key_decrypt data source:
data "tls_private_key_decrypt" "example" {
encrypted_pem = file("${path.module}/encrypted-key.pem")
passphrase = var.key_passphrase
}
Expected properties:
-
Accepts any standard PKCS#8 encrypted PEM private key format.
-
Returns decrypted PEM in the same format as tls_private_key resources.
-
Errors clearly if the passphrase is invalid or the format is unsupported.
How much impact is this issue causing?
High
Additional Information
The existing rsadecrypt() function is not applicable: it decrypts ciphertext with a private key, not PEM-encoded keys themselves.
The tls_private_key resource only generates new keys; it does not import or decrypt existing ones.
Related discussions:
Code of Conduct
Terraform CLI and Provider Versions
Terraform v1.7.5
Use Cases or Problem Statement
Many workflows and security policies require storing private keys encrypted in PEM format (e.g.,
-----BEGIN ENCRYPTED PRIVATE KEY-----).Today, there is no built-in function or provider resource in Terraform that can accept an encrypted PEM and return a decrypted private key.
This creates multiple challenges:
Users must pre-decrypt the key outside of Terraform (e.g., openssl rsa -in encrypted.pem -out decrypted.pem).
Automating secure workflows (for example, pipelines that provision resources requiring unencrypted keys) requires either:
custom external data sources shelling out to OpenSSL, or
storing decrypted keys in plaintext (undesirable).
This problem applies to any resource that consumes unencrypted private keys, not just AWS resources.
Having a native way to decrypt a PEM-encoded key directly in Terraform would enable secure, end-to-end workflows without manual steps or brittle external scripts.
Proposal
Introduce a Terraform built-in function (or a resource in the tls provider) to decrypt an encrypted PEM private key.
Example function syntax:
This function would return a decrypted PEM string.
Alternatively, this could be provided via the tls provider as a tls_private_key_decrypt data source:
Expected properties:
Accepts any standard PKCS#8 encrypted PEM private key format.
Returns decrypted PEM in the same format as tls_private_key resources.
Errors clearly if the passphrase is invalid or the format is unsupported.
How much impact is this issue causing?
High
Additional Information
The existing
rsadecrypt()function is not applicable: it decrypts ciphertext with a private key, not PEM-encoded keys themselves.The
tls_private_keyresource only generates new keys; it does not import or decrypt existing ones.Related discussions:
Code of Conduct