I am creating an ec2 instance for usage as a bastion host, using terraform. The instance is reached via an elastic ip. I deploy ssh-keys to the bastion host using a shell script inside the user_data directive. When I add or remove a key from the shell script the ec2 instance is redeployed to apply the changes. For that I use the user_data_replace_on_change directive.

My issue:

When I change something and the ec2 instance needs to be redeployed the host key verification fails, because the host changed. I don’t want to force users to periodically delete entries from their known_hosts files.

My question:

Is there an elegant way using terraform to persist the ssh host key setup throughout redeployments of the ec2 instance?