Connection blocks for SSH in Terraform - Time & Space Complexity

Time Complexity: Connection blocks for SSH

O(n)

Understanding Time Complexity

When Terraform uses connection blocks for SSH, it needs to connect to each resource to run commands or provision. We want to understand how the time to complete these connections grows as we add more resources.

How does the number of SSH connections affect the total execution time?

Scenario Under Consideration

Analyze the time complexity of the following Terraform connection block usage.

resource "aws_instance" "example" {
  count         = var.instance_count
  ami           = "ami-123456"
  instance_type = "t2.micro"

  connection {
    type        = "ssh"
    user        = "ec2-user"
    private_key = file("~/.ssh/id_rsa")
    host        = self.public_ip
  }

  provisioner "remote-exec" {
    inline = ["echo Hello World"]
  }
}

This code creates multiple AWS instances and connects to each via SSH to run a command.

Identify Repeating Operations

Identify the API calls, resource provisioning, data transfers that repeat.

• Primary operation: Establishing an SSH connection and running remote commands on each instance.
• How many times: Once per instance created (equal to var.instance_count).

How Execution Grows With Input

Each new instance requires a separate SSH connection and command execution. So, the total time grows directly with the number of instances.

Input Size (n)	Approx. Api Calls/Operations
10	10 SSH connections and command runs
100	100 SSH connections and command runs
1000	1000 SSH connections and command runs

Pattern observation: The number of SSH operations increases linearly as the number of instances increases.

Final Time Complexity

Time Complexity: O(n)

This means the total time to complete all SSH connections and commands grows directly in proportion to the number of instances.

Common Mistake

[X] Wrong: "Connecting to all instances via SSH happens all at once, so time stays the same no matter how many instances."

[OK] Correct: Each SSH connection and command runs separately, so more instances mean more total time, not constant time.

Interview Connect

Understanding how connection blocks scale helps you design infrastructure that runs efficiently and predict how long provisioning will take as your environment grows.

Self-Check

"What if we changed from SSH connections to a single centralized management system? How would the time complexity change?"

Practice

1. What is the main purpose of a connection block in Terraform when using SSH?

easy

A. To specify the Terraform backend storage

B. To define how Terraform connects to remote machines for running commands or copying files

C. To configure the cloud provider credentials

D. To create a new SSH key pair automatically

Solution

1. Step 1: Understand the role of connection blocks

   Connection blocks specify how Terraform connects to remote machines, typically using SSH, to run commands or transfer files during provisioning.

2. Step 2: Differentiate from other configurations

   SSH key creation, cloud credentials, and backend storage are configured elsewhere, not in connection blocks.

3. Final Answer:

   To define how Terraform connects to remote machines for running commands or copying files -> Option B

4. Quick Check:

   Connection block purpose = Define SSH connection [OK]

Hint: Connection blocks set SSH details for remote commands [OK]

Common Mistakes:

• Confusing connection block with SSH key creation
• Mixing connection block with cloud provider config
• Thinking connection block manages backend storage

2. Which of the following is the correct syntax to specify an SSH connection block in Terraform?

easy

A. connection { type = "winrm" user = "ubuntu" host = self.public_ip private_key = file("~/.ssh/id_rsa") }

B. connection { protocol = "ssh" username = "ubuntu" address = self.public_ip key = file("~/.ssh/id_rsa") }

C. connection { ssh_user = "ubuntu" ssh_host = self.public_ip ssh_key = file("~/.ssh/id_rsa") }

D. connection { user = "ubuntu" host = self.public_ip private_key = file("~/.ssh/id_rsa") }

Solution

1. Step 1: Recall Terraform connection block syntax

   The correct keys are user, host, and private_key. The type key is not required for SSH as it is the default.

2. Step 2: Identify the valid syntax

   connection { user = "ubuntu" host = self.public_ip private_key = file("~/.ssh/id_rsa") } uses correct keys without unnecessary or incorrect ones like type or protocol.

3. Final Answer:

   connection { user = "ubuntu" host = self.public_ip private_key = file("~/.ssh/id_rsa") } -> Option D

4. Quick Check:

   Correct keys = user, host, private_key [OK]

Hint: Use user, host, private_key keys in connection block [OK]

Common Mistakes:

• Adding unnecessary 'type' or 'protocol' keys
• Using wrong key names like ssh_user or username
• Omitting required keys like user or host

3. Given this Terraform snippet, what will happen when Terraform tries to connect?

connection {
  user = "admin"
  host = aws_instance.example.public_ip
  private_key = file("~/.ssh/id_rsa")
  timeout = "2m"
}

medium

A. Terraform will connect but ignore the timeout setting

B. Terraform will fail because timeout must be a number, not a string

C. Terraform will connect using SSH as user 'admin' with a 2-minute timeout

D. Terraform will connect using default user instead of 'admin'

Solution

1. Step 1: Analyze connection block fields

   The block correctly sets user, host, private_key, and timeout. Timeout accepts a duration string like "2m".

2. Step 2: Understand Terraform SSH connection behavior

   Terraform uses these values to connect via SSH as user 'admin' with a 2-minute timeout for connection attempts.

3. Final Answer:

   Terraform will connect using SSH as user 'admin' with a 2-minute timeout -> Option C

4. Quick Check:

   Timeout string '2m' is valid duration [OK]

Hint: Timeout accepts duration strings like '2m' for SSH connections [OK]

Common Mistakes:

• Thinking timeout must be numeric only
• Assuming default user is used ignoring 'user' key
• Believing timeout is ignored by Terraform

4. Identify the error in this Terraform connection block:

connection {
  user = "ec2-user"
  host = aws_instance.web.public_ip
  private_key = "~/.ssh/id_rsa"
}

medium

A. private_key should use file() function to read the key content

B. host should be a static IP, not a resource attribute

C. user must be 'ubuntu' for AWS instances

D. Missing 'type = "ssh"' in connection block

Solution

1. Step 1: Check private_key value type

   The private_key must contain the actual key content, not just the file path string. Using file("~/.ssh/id_rsa") reads the key content.

2. Step 2: Validate other fields

   Host can be a resource attribute, user can be 'ec2-user' for Amazon Linux, and 'type' defaults to SSH so it's optional.

3. Final Answer:

   private_key should use file() function to read the key content -> Option A

4. Quick Check:

   private_key needs file() to read key [OK]

Hint: Use file() to load private_key content, not just path string [OK]

Common Mistakes:

• Assigning private_key a file path string directly
• Assuming host cannot be a resource attribute
• Forcing user to 'ubuntu' regardless of OS

5. You want to run a remote command on an AWS instance using Terraform. Which connection block setup is best practice to ensure a reliable SSH connection?

hard

A. connection {
user = "ec2-user"
host = aws_instance.app.public_ip
private_key = file("~/.ssh/id_rsa")
timeout = "5m"
agent = true
}

B. connection {
user = "ec2-user"
host = aws_instance.app.public_ip
private_key = file("~/.ssh/id_rsa")
timeout = "1m"
agent = false
}

C. connection {
user = "ec2-user"
host = aws_instance.app.private_ip
private_key = file("~/.ssh/id_rsa")
timeout = "5m"
agent = true
}

D. connection {
user = "ubuntu"
host = aws_instance.app.public_ip
private_key = file("~/.ssh/id_rsa")
timeout = "30s"
agent = false
}

Solution

1. Step 1: Choose correct user and host

   For AWS Amazon Linux, user is usually 'ec2-user'. Public IP is needed for SSH from outside the VPC.

2. Step 2: Set appropriate timeout and agent

   A longer timeout like "5m" helps with slow connections. Using SSH agent forwarding (agent = true) can improve key management.

3. Step 3: Compare options

   connection { user = "ec2-user" host = aws_instance.app.public_ip private_key = file("~/.ssh/id_rsa") timeout = "5m" agent = true } uses correct user, public IP, sufficient timeout, and enables agent forwarding, matching best practices.

4. Final Answer:

   connection { user = "ec2-user" host = aws_instance.app.public_ip private_key = file("~/.ssh/id_rsa") timeout = "5m" agent = true } -> Option A

5. Quick Check:

   Public IP, correct user, timeout 5m, agent true = best practice [OK]

Hint: Use public IP, correct user, 5m timeout, and agent true for reliability [OK]

Common Mistakes:

• Using private IP when public IP is needed
• Setting too short timeout causing failures
• Disabling agent forwarding unnecessarily
• Using wrong user for the OS