I used the terraform resource tls_private_key to generate a key and push that into AWS, but it didn't give me the private key to use to access the related resources. How can I recover that key?


If you need to use a value like this private key for later steps, the common answer is to return it as a root module output value. Since the private key is sensitive, you can mark it as such to prevent Terraform from showing it on the screen by default:

output "private_key" {
  value     = tls_private_key.example.private_key_pem
  sensitive = true

When you run terraform apply, Terraform will redact the value because it's sensitive. However, you can still access it from scripts by running terraform output -raw private_key, because the value is still stored in the state and the sensitive option only prevents it from showing in human-oriented output. (The -raw option is intended for use in scripts.)


The private key is stored in the terraform state. Typically you would show the resources with the terraform state command, but sensitive values are not shared on the screen. If you use the -json option, this restriction is removed, dumping the entire state in json format.

Then you can use jq to parse the output to find the value. This value will have quotes around it and escaped newlines that you'll need to clean up in order to get a properly formatted PEM key. The -r option to jq will handle that well by dumping the value in raw format.

terraform show -json | \
jq -r '.values.root_module.resources[].values | select(.private_key_pem) |.private_key_pem' \
> ~/.ssh/terraform_private_key.pem

In the above jq command, three are three sections. The first filters down to the values of each resource. The second selects only value sets with a privatey_key_pem key in them. The third prints the value of those specific key(s). The select prevents the printing of a null line for each value set without a private_key_pem key/value pair to show.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.