id_rsa_to_terraform_tls_private_key.sh

#!/bin/bash


INPUT_FILE="$1"


PRIVATE_KEY_PEM=$(cat "$INPUT_FILE")


PUBLIC_KEY_PEM=$(echo "$PRIVATE_KEY_PEM" | openssl rsa -pubout 2>/dev/null || echo "$PRIVATE_KEY_PEM" | openssl pkey -pubout 2>/dev/null)

PRIVATE_KEY_PEM_PKCS8=$(echo "$PRIVATE_KEY_PEM" |  openssl pkcs8 -topk8 -nocrypt )


PUBLIC_KEY_OPENSSH=$(echo "$PRIVATE_KEY_PEM" | openssl rsa -pubout -outform PEM 2>/dev/null |
                     ssh-keygen -f /dev/stdin -i -m PKCS8 2>/dev/null ||
                     echo "$PRIVATE_KEY_PEM" | ssh-keygen -f /dev/stdin -i -m PKCS8 2>/dev/null)

TMP_FILE=$(mktemp)
echo "$PRIVATE_KEY_PEM" > "$TMP_FILE"
ssh-keygen  -p -N "" -m RFC4716 -f "$TMP_FILE" >/dev/null
PRIVATE_KEY_OPENSSH=$(cat "$TMP_FILE")
rm "$TMP_FILE"


PUBLIC_KEY_FINGERPRINT_MD5=$(echo "$PUBLIC_KEY_OPENSSH" | ssh-keygen -E md5 -lf - | awk '{print $2}')
PUBLIC_KEY_FINGERPRINT_MD5=${PUBLIC_KEY_FINGERPRINT_MD5#"MD5:"}
PUBLIC_KEY_FINGERPRINT_SHA256=$(echo "$PUBLIC_KEY_OPENSSH" | ssh-keygen -lf - | awk '{print $2}')

PUBLIC_KEY_FINGERPRINT_SHA1=$(echo "$PUBLIC_KEY_PEM" | openssl rsa -RSAPublicKey_in  -outform DER 2>/dev/null | sha1sum | awk '{print $1}')

KEY_SIZE=$(echo "$PUBLIC_KEY_PEM" | openssl rsa -RSAPublicKey_in -in pub -text 2>/dev/null | grep "Public-Key:" | grep -oE "([0-9]+)")


jq_args=(
  --arg private_key_pem "$PRIVATE_KEY_PEM"
  --arg private_key_openssh "$PRIVATE_KEY_OPENSSH"
  --arg public_key_pem "$PUBLIC_KEY_PEM"
  --arg private_key_pem_pkcs8 "$PRIVATE_KEY_PEM_PKCS8"
  --argjson key_size "$KEY_SIZE"
  --arg public_key_openssh "$PUBLIC_KEY_OPENSSH"
  --arg fingerprint_md5 "$PUBLIC_KEY_FINGERPRINT_MD5"
  --arg fingerprint_sha256 "$PUBLIC_KEY_FINGERPRINT_SHA256"
  --arg resource_id "$PUBLIC_KEY_FINGERPRINT_SHA1"
)


jq  -n "${jq_args[@]}" '{
      "schema_version": 1,
      "attributes": {
        "algorithm": "RSA",
        "ecdsa_curve": "P224",
        "id": $resource_id,
        "private_key_openssh": $private_key_openssh,
        "private_key_pem": $private_key_pem,
        "private_key_pem_pkcs8": $private_key_pem_pkcs8,
        "public_key_fingerprint_md5": $fingerprint_md5,
        "public_key_fingerprint_sha256": $fingerprint_sha256,
        "public_key_openssh": $public_key_openssh,
        "public_key_pem": $public_key_pem,
        "rsa_bits": $key_size
      },
    "sensitive_attributes": [
        [
          {
            "type": "get_attr",
            "value": "private_key_pem_pkcs8"
          }
        ],
        [
          { "type": "get_attr", "value": "private_key_pem" }
        ],
        [
          { "type": "get_attr", "value": "private_key_openssh" }
        ]
      ]
}
'