About Configuring Terraform on Windows Systems
To use Terraform to create Oracle Cloud Infrastructure components, you must download and install Terraform. You’ll also download the Terraform modules that create the configuration files that you’ll use create the required infrastructure components.
The system where you install Terraform and store the Teraform modules can be either on premises or in the cloud. For convenience, we’ll refer to this as your local system or your local host.
Before you run Terraform:
-
Generate an SSH key pair used to allow you to access your Compute instances
-
Generate an API signing key used to authenticate API calls made by Terraform
-
Set environment variables used by Terraform to authenticate access and execute its plans
After completing these steps, you’re ready to apply the Terraform configuration files to create your infrastructure components on Oracle Cloud Infrastructure.
Install Terraform
To install Terraform on a Windows system, download the appropriate package from the Terraform web site.
Generate an SSH Key Pair to Access the Bastion Hosts
An SSH key pair is used to allow you to securely access instances that are created in public subnets. You generate an SSH key pair on your local host. The Terraform modules then add the SSH public key to the bastion hosts. When you need to connect to the bastion host over the public Internet, you provide the SSH private key to authenticate access.
You can generate an SSH key pair using PuTTYgen. Don’t set a passphrase for your SSH key.
Generate an SSH Key Pair to Access Other Instances
Bastion hosts are used to enable SSH forwarding to other instances that don’t have public IP addresses and don’t allow access over the public internet. To securely access other instances from the bastion host, you use an SSH key pair where the public key stored on instances in private subnets matches a private key that’s stored on your local machine.
The SSH key pair used to enable access from the bastion host to other instances must be generated using a utility such as OpenSSL or ssh-keygen.
You can’t use an SSH key pair generated on Windows using PuTTY, because the .ppk
format used by PuTTY isn’t supported on Oracle Linux or other UNIX-like operating systems. Remember that the bastion host, which forwards the SSH traffic to other instances, uses an Oracle Linux image.
Generate an API Signing Key
You must supply an RSA key pair in Privacy Enhanced Mail (PEM) format to authenticate your Terraform script with Oracle Cloud Infrastructure. Note that this API signing key isn’t the same as the SSH key pair that you use to access your instances. You can generate this key pair using OpenSSL in Git Bash. You should have already installed Git Bash on your local system.
- Start Git Bash.
- Create a hidden folder to store the PEM key. You can store the PEM key in any location, but for simplicity, create this folder under the folder where Terraform modules are located. Ensure that you make a note of the location where you store the key pair. Navigate to that location and enter:
mkdir ./.oci
- To create the API signing key, enter:
openssl genrsa -out ./.oci/key_name.pem 2048
- Change permissions on the private key to ensure that only you can read the private key. Enter:
chmod go-rwx ./.oci/key_name.pem
- Next, to generate the public key for the given private key, enter:
openssl rsa -pubout -in ./.oci/key_name.pem -out ./.oci/key_name_public.pem
Upload the API Signing Key Using the Console
After you’ve generated an API signing key, you must upload the public key for the associated user in Oracle Cloud Infrastructure. The first time you upload an API signing key, you must use the Console. Subsequently, you can also use the API to upload an API key.
- Sign in to the Oracle Cloud Infrastructure Console.
- Click Identity and then click Users.
- Click the user for whom you want to add the API signing key.
- On the user details page, click Add Public Key.
- On your local system, launch Git Bash. Navigate to the folder where you stored your API signing key pair.
- To copy the public key, enter:
cat ./key_name_public.pem.
The public key value is displayed. Copy this value, including the lines-----BEGIN PUBLIC KEY-----
and-----END PUBLIC KEY-----.
- In the Console, paste the public key value and click Add.