How to fix Error: ssh: handshake failed in Terraform

ssh -i /path/to/private/key.pem ubuntu@instance-ip-address

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  key_name      = aws_key_pair.deployer.key_name

  connection {
    type        = "ssh"
    user        = "ubuntu"  # or ec2-user, centos, etc - depends on AMI
    private_key = file("~/.ssh/my-key.pem")  # CORRECT
    # NOT: key_file = "~/.ssh/my-key.pem"  # WRONG - deprecated
    host        = self.public_ip
  }

  provisioner "remote-exec" {
    inline = [
      "echo 'Connected!'"
    ]
  }
}

variable "private_key" {
  type      = string
  sensitive = true
}

connection {
  type        = "ssh"
  user        = "ubuntu"
  private_key = var.private_key
  host        = self.public_ip
}

# Ubuntu AMI
connection {
  type        = "ssh"
  user        = "ubuntu"  # Ubuntu's default user
  private_key = file("~/.ssh/key.pem")
  host        = self.public_ip
}

# Amazon Linux 2
connection {
  type        = "ssh"
  user        = "ec2-user"  # Amazon Linux's default user
  private_key = file("~/.ssh/key.pem")
  host        = self.public_ip
}

# Check current permissions
ls -la ~/.ssh/my-key.pem

# Set correct permissions (read/write for owner only)
chmod 600 ~/.ssh/my-key.pem

# Or for older systems
chmod 400 ~/.ssh/my-key.pem

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  key_name      = aws_key_pair.deployer.key_name

  connection {
    type        = "ssh"
    user        = "ubuntu"
    private_key = file("~/.ssh/key.pem")
    host        = self.public_ip

    # Allow up to 2 minutes for the instance to be ready
    timeout = "2m"
  }

  # Optional: wait for instance status checks to pass
  provisioner "remote-exec" {
    inline = [
      "echo 'Instance is ready'"
    ]
  }

  depends_on = [aws_instance.example]
}

# Or add an explicit wait
resource "time_sleep" "wait_for_instance" {
  depends_on = [aws_instance.example]

  create_duration = "30s"
}

resource "aws_instance" "example" {
  # ... configuration ...

  provisioner "remote-exec" {
    inline = ["echo 'Instance ready'"]
  }

  depends_on = [time_sleep.wait_for_instance]
}

resource "aws_security_group" "allow_ssh" {
  name = "allow_ssh"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["YOUR_IP/32"]  # Restrict to your IP for security
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "example" {
  # ... other configuration ...
  vpc_security_group_ids = [aws_security_group.allow_ssh.id]
}

connection {
  type            = "ssh"
  user            = "ubuntu"
  private_key     = file("~/.ssh/key.pem")
  host            = self.public_ip

  # Disable SSH agent to avoid conflicts
  agent           = false

  # Skip host key verification (less secure, but useful for testing)
  # This adds the host to known_hosts automatically
  host_key        = "ignore"  # Terraform 1.2+
}

# Extract the public key from your private key
ssh-keygen -y -f ~/.ssh/my-key.pem

# On the remote instance, check authorized_keys
ssh -i ~/.ssh/my-key.pem ubuntu@instance-ip
cat ~/.ssh/authorized_keys

resource "aws_key_pair" "deployer" {
  key_name   = "deployer-key"
  public_key = file("~/.ssh/my-key.pub")
}

resource "aws_instance" "example" {
  key_name = aws_key_pair.deployer.key_name
}

# Generate an RSA key (most compatible)
ssh-keygen -t rsa -b 4096 -f ~/.ssh/terraform-rsa.pem -N ""

# Or ed25519 (more modern, smaller)
ssh-keygen -t ed25519 -f ~/.ssh/terraform-ed25519.pem -N ""

# Or ECDSA
ssh-keygen -t ecdsa -b 521 -f ~/.ssh/terraform-ecdsa.pem -N ""

connection {
  type        = "ssh"
  user        = "ubuntu"
  private_key = file("~/.ssh/terraform-rsa.pem")  # Try different keys
  host        = self.public_ip
}

# Enable debug logging
export TF_LOG=DEBUG

# Run your Terraform command
terraform apply

# Save to a file for easier analysis
export TF_LOG_PATH=./terraform-debug.log
terraform apply

# Disable when done
unset TF_LOG
unset TF_LOG_PATH