How to fix Error: ssh: unable to authenticate in Terraform

Test if you can connect to the remote host using standard SSH command:

ssh -i /path/to/private/key -u [email protected]

If manual SSH succeeds but Terraform fails, the issue is with Terraform's SSH configuration, not the connection itself. If manual SSH also fails, verify the key and host are correct before proceeding.

Add a proper connection block to your Terraform provisioner. Use the file() function to read the actual key contents, not just the key name:

resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  key_name      = "my-key"

  provisioner "remote-exec" {
    inline = ["echo Connected!"]

    connection {
      type        = "ssh"
      user        = "ec2-user"  # Use correct user for your AMI
      private_key = file("~/.ssh/my-key.pem")
      host        = self.public_ip
      timeout     = "5m"
    }
  }
}

The critical parts:
- Use file("path/to/key") not just the key name
- Specify correct user for your OS (ec2-user, ubuntu, centos, admin, etc.)
- Use host = the actual IP or hostname

If your private key is password-protected, Terraform cannot use it directly. Instead, use the SSH agent:

connection {
  type  = "ssh"
  user  = "ubuntu"
  agent = true  # Use SSH agent for key authentication
  host  = self.public_ip
}

Before running Terraform, ensure your key is loaded:

ssh-add ~/.ssh/my-key.pem

This prompts for the passphrase once, then SSH agent handles authentication.

Some cloud providers have delays before SSH is fully ready. Increase the timeout:

connection {
  type        = "ssh"
  user        = "ubuntu"
  private_key = file("~/.ssh/key.pem")
  host        = self.public_ip
  timeout     = "10m"  # Increased from default
}

If the remote instance takes time to configure authorized_keys, you can also add a small delay:

provisioner "remote-exec" {
  inline = ["echo Connected!"]

  connection {
    type        = "ssh"
    user        = "ubuntu"
    private_key = file("~/.ssh/key.pem")
    host        = self.public_ip
  }

  depends_on = [aws_instance.example]
}

SSH requires private keys to have restrictive permissions (600). Check your key:

ls -l ~/.ssh/my-key.pem

Should show: -rw------- 1 user group (600 permissions)

Fix if needed:

chmod 600 ~/.ssh/my-key.pem

Also verify the key format is correct (should start with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN EC PRIVATE KEY-----).

If agent-based authentication has issues, try explicitly disabling it:

connection {
  type        = "ssh"
  user        = "ubuntu"
  private_key = file("~/.ssh/key.pem")
  host        = self.public_ip
  agent       = false  # Force key-based auth without agent
  timeout     = "5m"
}

This forces Terraform to use the private_key file directly instead of delegating to SSH agent.