Add SSH certificate authentication method for connection via Bastion

[binlab]

In our company, we are using Hashicorp Vault together with a Terraform for granting temporary credentials for developers and services. For example, for reasons, when you need to run Terraform in a container as a service you will need to give SSH access (password or RSA keys) for a short time (for deploying or redeploying) and then withdraw access. In the best practices - secrets, token or keys never should leave a place where was created. Ideally, the solution, in this case, will generate RSA pair on the service and sign the public key with the Vault SSH Secrets Engine. Using SSH connection by certificate access already implemented in 0.12.x version of Terraform, but miss a certificate method for connections via Bastion. This PR adds missing functionality into Terraform by new parameter - bastion_certificate.
A short example of how we using this functionality:

resource "aws_instance" "vault" {
...
  connection {
    type        = "ssh"
    host        = self.private_ip
    port        = var.ec2_port
    user        = var.ec2_user
    agent       = false
    timeout     = "2m"
    private_key = file("~/.ssh/id_rsa")
    certificate = file("~/.ssh/id_rsa-cert.pub")

    bastion_host        = aws_instance.bastion.public_ip
    bastion_user        = var.bastion_user
    bastion_port        = var.bastion_port
    bastion_private_key = file("~/.ssh/id_rsa")
    bastion_certificate = file("~/.ssh/id_rsa-cert.pub")
  }
...
}

[dzirg44]

Would be nice to have this functionality ! 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.