github.com/vtorhonen/terraform@v0.9.0-beta2.0.20170307220345-5d894e4ffda7/website/source/docs/provisioners/connection.html.markdown (about) 1 --- 2 layout: "docs" 3 page_title: "Provisioner Connections" 4 sidebar_current: "docs-provisioners-connection" 5 description: |- 6 Managing connection defaults for SSH and WinRM using the `connection` block. 7 --- 8 9 # Provisioner Connections 10 11 Many provisioners require access to the remote resource. For example, 12 a provisioner may need to use SSH or WinRM to connect to the resource. 13 14 Terraform uses a number of defaults when connecting to a resource, but these 15 can be overridden using a `connection` block in either a `resource` or `provisioner`. 16 Any `connection` information provided in a `resource` will apply to all the 17 provisioners, but it can be scoped to a single provisioner as well. One use case 18 is to have an initial provisioner connect as the `root` user to setup user accounts, and have 19 subsequent provisioners connect as a user with more limited permissions. 20 21 ## Example usage 22 23 ``` 24 # Copies the file as the root user using SSH 25 provisioner "file" { 26 source = "conf/myapp.conf" 27 destination = "/etc/myapp.conf" 28 29 connection { 30 type = "ssh" 31 user = "root" 32 password = "${var.root_password}" 33 } 34 } 35 36 # Copies the file as the Administrator user using WinRM 37 provisioner "file" { 38 source = "conf/myapp.conf" 39 destination = "C:/App/myapp.conf" 40 41 connection { 42 type = "winrm" 43 user = "Administrator" 44 password = "${var.admin_password}" 45 } 46 } 47 ``` 48 49 ## Argument Reference 50 51 **The following arguments are supported by all connection types:** 52 53 * `type` - The connection type that should be used. Valid types are `ssh` and `winrm` 54 Defaults to `ssh`. 55 56 * `user` - The user that we should use for the connection. Defaults to `root` when 57 using type `ssh` and defaults to `Administrator` when using type `winrm`. 58 59 * `password` - The password we should use for the connection. In some cases this is 60 specified by the provider. 61 62 * `host` - The address of the resource to connect to. This is usually specified by the provider. 63 64 * `port` - The port to connect to. Defaults to `22` when using type `ssh` and defaults 65 to `5985` when using type `winrm`. 66 67 * `timeout` - The timeout to wait for the connection to become available. This defaults 68 to 5 minutes. Should be provided as a string like `30s` or `5m`. 69 70 * `script_path` - The path used to copy scripts meant for remote execution. 71 72 **Additional arguments only supported by the `ssh` connection type:** 73 74 * `private_key` - The contents of an SSH key to use for the connection. These can 75 be loaded from a file on disk using the [`file()` interpolation 76 function](/docs/configuration/interpolation.html#file_path_). This takes 77 preference over the password if provided. 78 79 * `agent` - Set to `false` to disable using `ssh-agent` to authenticate. On Windows the 80 only supported SSH authentication agent is 81 [Pageant](http://the.earth.li/~sgtatham/putty/0.66/htmldoc/Chapter9.html#pageant). 82 83 **Additional arguments only supported by the `winrm` connection type:** 84 85 * `https` - Set to `true` to connect using HTTPS instead of HTTP. 86 87 * `insecure` - Set to `true` to not validate the HTTPS certificate chain. 88 89 * `cacert` - The CA certificate to validate against. 90 91 <a id="bastion"></a> 92 ## Connecting through a Bastion Host with SSH 93 94 The `ssh` connection also supports the following fields to facilitate connnections via a 95 [bastion host](https://en.wikipedia.org/wiki/Bastion_host). 96 97 * `bastion_host` - Setting this enables the bastion Host connection. This host 98 will be connected to first, and then the `host` connection will be made from there. 99 100 * `bastion_port` - The port to use connect to the bastion host. Defaults to the 101 value of the `port` field. 102 103 * `bastion_user` - The user for the connection to the bastion host. Defaults to 104 the value of the `user` field. 105 106 * `bastion_password` - The password we should use for the bastion host. 107 Defaults to the value of the `password` field. 108 109 * `bastion_private_key` - The contents of an SSH key file to use for the bastion 110 host. These can be loaded from a file on disk using the [`file()` 111 interpolation function](/docs/configuration/interpolation.html#file_path_). 112 Defaults to the value of the `private_key` field.