Nexus Linux machine uses SSH keys

docs/tre-templates/shared-services/nexus.md

@@ -46,7 +46,6 @@ This will deploy the infrastructure required for Nexus, then start the service a
 
 ## Setup and usage
 
-1. A TRE Administrator can access Nexus though the admin jumpbox provisioned as part of the TRE deployment. The username is `adminuser` and the password is located in the Key Vault under `vm-<tre-id>-jumpbox-password`
 2. A researcher can access Nexus from within the workspace by using the internal Nexus URL of `https://nexus-{TRE_ID}.{LOCATION}.cloudapp.azure.com`
 3. To fetch Python packages from the PyPI proxy, a researcher can use `pip install` while specifying the proxy server:
 
@@ -201,3 +200,7 @@ for ext in "${extensions[@]}"; do
     fi
 done
 ```
+
+# Virtual Machine Credentials
+
+A TRE Administrator can access Nexus though the bastion provisioned as part of the TRE deployment. The username is `adminuser` and the SSH private key is located in the Key Vault under `nexus-ssh-private-key`.

templates/shared_services/sonatype-nexus-vm/terraform/vm.tf

@@ -34,19 +34,6 @@ resource "azurerm_private_dns_a_record" "nexus_vm" {
   lifecycle { ignore_changes = [tags] }
 }
 
-resource "random_password" "nexus_vm_password" {
-  length           = 16
-  lower            = true
-  min_lower        = 1
-  upper            = true
-  min_upper        = 1
-  numeric          = true
-  min_numeric      = 1
-  special          = true
-  min_special      = 1
-  override_special = "_%@"
-}
-
 resource "random_password" "nexus_admin_password" {
   length           = 16
   lower            = true
@@ -60,15 +47,6 @@ resource "random_password" "nexus_admin_password" {
   override_special = "_%"
 }
 
-resource "azurerm_key_vault_secret" "nexus_vm_password" {
-  name         = "nexus-vm-password"
-  value        = random_password.nexus_vm_password.result
-  key_vault_id = data.azurerm_key_vault.kv.id
-  tags         = local.tre_shared_service_tags
-
-  lifecycle { ignore_changes = [tags] }
-}
-
 resource "azurerm_key_vault_secret" "nexus_admin_password" {
   name         = "nexus-admin-password"
   value        = random_password.nexus_admin_password.result
@@ -99,9 +77,8 @@ resource "azurerm_linux_virtual_machine" "nexus" {
   location                        = data.azurerm_resource_group.rg.location
   network_interface_ids           = [azurerm_network_interface.nexus.id]
   size                            = var.vm_size
-  disable_password_authentication = false
+  disable_password_authentication = true
   admin_username                  = "adminuser"
-  admin_password                  = random_password.nexus_vm_password.result
   tags                            = local.tre_shared_service_tags
   encryption_at_host_enabled      = true
   secure_boot_enabled             = true
@@ -143,12 +120,12 @@ resource "azurerm_linux_virtual_machine" "nexus" {
   ]
 
   connection {
-    type     = "ssh"
-    host     = azurerm_network_interface.nexus.private_ip_address
-    user     = "adminuser"
-    password = random_password.nexus_vm_password.result
-    agent    = false
-    timeout  = "10m"
+    type        = "ssh"
+    host        = azurerm_network_interface.nexus.private_ip_address
+    user        = "adminuser"
+    private_key = azurerm_key_vault_secret.ssh_private_key.value
+    agent       = false
+    timeout     = "10m"
   }
 }
 
@@ -274,3 +251,26 @@ resource "azurerm_virtual_machine_extension" "keyvault" {
 
   lifecycle { ignore_changes = [tags] }
 }
+
+resource "tls_private_key" "ssh_key" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "azurerm_key_vault_secret" "ssh_private_key" {
+  name         = "nexus-ssh-private-key"
+  value        = tls_private_key.ssh_key.private_key_pem
+  key_vault_id = data.azurerm_key_vault.kv.id
+  tags         = local.tre_shared_service_tags
+
+  lifecycle { ignore_changes = [tags] }
+}
+
+resource "azurerm_key_vault_secret" "ssh_public_key" {
+  name         = "nexus-ssh-public-key"
+  value        = tls_private_key.ssh_key.public_key_openssh
+  key_vault_id = data.azurerm_key_vault.kv.id
+  tags         = local.tre_shared_service_tags
+
+  lifecycle { ignore_changes = [tags] }
+}