Deploy SSH Keypairs with Terraform

Manage SSH keypairs on Bahriya with Terraform: store a public key and PEM private key, attach them to projects and mount them as files on containers.

Updated 31 Oct 20262 min read

An SSH keypair stores an SSH public key and its PEM-encoded private key. SSH keypairs are scoped to your organisation, versioned with rotation history, and can be attached to projects and containers.

Required fields

Field	Type	Description
`handle`	string	A unique identifier (DNS-1123 compliant: lowercase, alphanumeric, hyphens).
`name`	string	A display name.
`publickey`	string	SSH public key line (e.g. `ssh-rsa AAAA... user@host`).
`privatekey`	string	PEM-encoded private key.

Read-only fields

Field	Type	Description
`keyid`	string	SHA256 fingerprint.
`algorithm`	string	Key algorithm (ssh-rsa, ssh-ed25519, etc.).
`keybits`	integer	Key size in bits (RSA only).
`comment`	string	Comment from the public key line.
`currentversion`	integer	The currently active version number.
`versioncount`	integer	How many versions are kept, the current one included.

Example

resource "bahriya_ssh_keypair" "deploy_key" {
  handle     = "deploy-key"
  name       = "Production Deploy Key"
  publickey  = file("${path.module}/keys/deploy.pub")
  privatekey = file("${path.module}/keys/deploy")
}

Attach it to a project so it deploys to the project's regions:

resource "bahriya_project" "production" {
  handle  = "production"
  name    = "Production"
  regions = ["helsinki-1", "falkenstein-1"]
}
 
resource "bahriya_project_ssh_keypair_attachment" "deploy_key" {
  project_id = bahriya_project.production.id
  handle     = bahriya_ssh_keypair.deploy_key.handle
}

Then mount it on a container — the public and private keys land as files in mountpath:

resource "bahriya_container" "deployer" {
  # ... other fields ...
 
  sshkeypairs = [
    {
      handle    = bahriya_ssh_keypair.deploy_key.handle
      mountpath = "/etc/bahriya/ssh"
    },
  ]
}

To rotate key material, update the publickey and privatekey fields in your Terraform config and run terraform apply. The Bahriya API creates a new version and marks it current. Previous versions are retained for rollback (default: last 5).

After rotation, file-mounted containers pick up the new keys automatically within about 60 seconds. No manual redeploy is needed for file-mounted keys.

Importing an existing keypair

terraform import bahriya_ssh_keypair.deploy_key <uuid>

Pricing

SSH keypairs are billed at $0.02 per month while they exist in your organisation, plus $0.02 per region per month when attached to a project.