Nebulous error upon using non-RSA key pair on AWS

[samuel-elliott]

terraform -version
Terraform v0.14.6
+ provider registry.terraform.io/hashicorp/aws v3.28.0
lsb_release -a
Description:    CentOS Linux release 8.3.2011
Release:        8.3.2011

While practicing with Terraform in my personal AWS environment, I used the following code while working on Terraform functions:

resource "aws_key_pair" "loginkey" {
  key_name   = "login-key"
  public_key = file("${path.module}/id_rsa.pub")
}

As is usually my habit when working with ssh-keygen, I generated an ed25519 key. Upon attempting to use it, Terraform greeted me with the following error:

aws_key_pair.loginkey: Creating...

Error: Error import KeyPair: InvalidKey.Format: Key is not in valid OpenSSH public key format
        status code: 400, request id: 54d0c365-8ab5-49b5-8420-9108084eb183

It did not take long at all to find and subsequently remember that AWS only supports RSA keys as of this time. ed25519, ECDSA, and DSA keys all result in the same error, which I have just verified. Curiously enough, the first link below mentions that AWS uses 2,048 bit RSA keys, but I have just used Terraform to use 4,096 and 8,192 bit RSA keys, insert them into my account's Key Pairs, and connect to the resulting EC2 instances just fine as long as they are newer, such as RHEL 8. Amazon Linux 2 errors out, curiously enough.

Amazon EC2 key pairs and Linux instances (docs.aws.amazon.com)

Unanswered Amazon forums thread of people requesting ed25519 key support (forums.aws.amazon.com)

Would it be possible to update the error handling for this particular module such that, if it detects a non-RSA key being imported, it tells the user something along the lines of "Only RSA SSH keys are supported as of this time. Please reference an RSA key to function properly with AWS EC2 instances."

[antonbabenko]

Hi @samuel-elliott !

The error message you see is coming from AWS API or from Terraform AWS provider. There is nothing that we can do in this module.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.