Add SSH cert authentication method for connection via Bastion

communicator/ssh/communicator.go

@@ -155,11 +155,13 @@ func (c *Communicator) Connect(o terraform.UIOutput) (err error) {
 					"  User: %s\n"+
 					"  Password: %t\n"+
 					"  Private key: %t\n"+
+					"  Certificate: %t\n"+
 					"  SSH Agent: %t\n"+
 					"  Checking Host Key: %t",
 				c.connInfo.BastionHost, c.connInfo.BastionUser,
 				c.connInfo.BastionPassword != "",
 				c.connInfo.BastionPrivateKey != "",
+				c.connInfo.BastionCertificate != "",
 				c.connInfo.Agent,
 				c.connInfo.BastionHostKey != "",
 			))

communicator/ssh/provisioner.go

@@ -56,6 +56,7 @@ type connectionInfo struct {
 	BastionUser        string `mapstructure:"bastion_user"`
 	BastionPassword    string `mapstructure:"bastion_password"`
 	BastionPrivateKey  string `mapstructure:"bastion_private_key"`
+	BastionCertificate string `mapstructure:"bastion_certificate"`
 	BastionHost        string `mapstructure:"bastion_host"`
 	BastionHostKey     string `mapstructure:"bastion_host_key"`
 	BastionPort        int    `mapstructure:"bastion_port"`
@@ -123,6 +124,9 @@ func parseConnectionInfo(s *terraform.InstanceState) (*connectionInfo, error) {
 		if connInfo.BastionPrivateKey == "" {
 			connInfo.BastionPrivateKey = connInfo.PrivateKey
 		}
+		if connInfo.BastionCertificate == "" {
+			connInfo.BastionCertificate = connInfo.Certificate
+		}
 		if connInfo.BastionPort == 0 {
 			connInfo.BastionPort = connInfo.Port
 		}
@@ -176,6 +180,7 @@ func prepareSSHConfig(connInfo *connectionInfo) (*sshConfig, error) {
 			privateKey:  connInfo.BastionPrivateKey,
 			password:    connInfo.BastionPassword,
 			hostKey:     connInfo.HostKey,
+			certificate: connInfo.BastionCertificate,
 			sshAgent:    sshAgent,
 		})
 		if err != nil {

terraform/eval_validate.go

@@ -291,6 +291,10 @@ var connectionBlockSupersetSchema = &configschema.Block{
 			Type:     cty.String,
 			Optional: true,
 		},
+		"bastion_certificate": {
+			Type:     cty.String,
+			Optional: true,
+		},
 
 		// For type=winrm only (enforced in winrm communicator)
 		"https": {

website/docs/provisioners/connection.html.markdown

@@ -126,3 +126,7 @@ The `ssh` connection also supports the following fields to facilitate connnectio
   host. These can be loaded from a file on disk using
   [the `file` function](/docs/configuration/functions/file.html).
   Defaults to the value of the `private_key` field.
+
+* `bastion_certificate` - The contents of a signed CA Certificate. The certificate argument
+  must be used in conjunction with a `bastion_private_key`. These can be loaded from
+  a file on disk using the [the `file` function](/docs/configuration/functions/file.html).