Create a PGP key. Select RSA and RSA and a key size of 4096. Enter your name and email address.
When you hit O or Okay you’ll be prompted to enter a passphrase. Skip this by hitting Enter.
erickkendall@ekendall terraform-user % gpg --full-gen-key
gpg (GnuPG) 2.3.7; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
(9) ECC (sign and encrypt) *default*
(10) ECC (sign only)
(14) Existing key from card
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
GnuPG needs to construct a user ID to identify your key.
Real name: Erick Kendall
Email address: erick.kendall@darvis.com
Comment:
You selected this USER-ID:
"Erick Kendall <erick.kendall@darvis.com>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
Export the key.
gpg --export "Erick Kendall" | base64
The output from command, above is the pgp_key. The full PGP key not shown.
resource "aws_iam_user" "user" {
name = "demo_user"
path = "/"
}
resource "aws_iam_access_key" "user_access_key" {
user = aws_iam_user.user.name
pgp_key="mQINBGL9N1IBEAD..."
}
output "access_key_id" {
value = aws_iam_access_key.user_access_key.id
}
output "secret_access_key" {
value = aws_iam_access_key.user_access_key.encrypted_secret
}
The access key will be presented but the secret key will need to be decrypted.
terraform output secret_access_key | base64 --decode | gpg --decrypt
The output from the above command shown with the secret key abbreviated for security. Note do not include the % at the end when configuring AWS credentials.
gpg: encrypted with rsa4096 key, ID 5518F93E3406A857, created 2022-08-17
"Erick Kendall <erick.kendall@darvis.com>"
z9kD/00ApENQFj/MKuZ/...%
Recent Comments