Managing SSH Keys

Use when:

• Adding or generating an SSH key for Acquia Cloud
• Listing or deleting SSH keys
• Setting up SSH access for IDEs or CI/CD pipelines

SSH keys provide secure authentication to Acquia Cloud resources without needing to enter passwords.

Why SSH Keys?

SSH keys allow you to:

• Securely access your IDEs without entering a password
• Push code to your repositories
• Execute remote commands on your servers
• Automate deployments in scripts or CI/CD pipelines

List Your SSH Keys

See all your SSH keys

acli ssh-key:list

Output:

SSH Keys for your account:
  [0] My Laptop (generated 2024-01-15)
      Fingerprint: ab:cd:ef:12:34:56:78:90
  [1] Work Desktop (generated 2024-02-01)
      Fingerprint: 11:22:33:44:55:66:77:88

List keys per IDE

acli ide:ssh-key:list

Generate a New SSH Key

Create an SSH key interactively

acli ssh-key:create

This will:

1. Prompt for a label (e.g., "My Laptop", "CI Server")
2. Generate a public/private key pair
3. Store the public key in your Acquia account
4. Save the private key locally (usually ~/.ssh/id_rsa)

Example:

$ acli ssh-key:create
? Enter a label for this SSH key: My Laptop
✓ SSH key created!
  Public key added to your account.
  Private key saved to: ~/.ssh/id_rsa
  Fingerprint: ab:cd:ef:12:34:56:78:90

Note: The label prompt is the last step before the key is generated and permanently added to your Acquia account. Confirm your label is correct before pressing Enter.

Upload an Existing SSH Key

If you already have an SSH key, upload it without regenerating:

acli ssh-key:upload --filepath ~/.ssh/id_rsa.pub --label "Existing Key"

Or interactively:

acli ssh-key:upload

Prompts you to select the key file and enter a label.

Skip waiting for propagation

By default, acli waits for the key to propagate to all servers. Skip this with:

acli ssh-key:upload --filepath ~/.ssh/id_rsa.pub --label "My Key" --no-wait

Create and Upload in One Step

Generate a new key locally and upload it to Cloud Platform in a single command:

acli ssh-key:create-upload

Options:

acli ssh-key:create-upload \
  --filename=my_key \
  --password="" \
  --label="My New Key" \
  --no-wait

Inspect an SSH Key

Get details about a specific key by fingerprint:

acli ssh-key:info --fingerprint="ab:cd:ef:12:34:56:78:90"

Useful for confirming which key is registered before deleting.

Delete an SSH Key

Remove a key from your account

acli ssh-key:delete

Prompts which key to delete:

? Select the SSH key to delete: [0] My Laptop
? Delete "My Laptop"? (yes/no)
✓ SSH key deleted.

Non-interactive delete

acli ssh-key:delete --public-key "ab:cd:ef:12:34:56:78:90"

Using SSH Keys with IDEs

SSH into your IDE

Once you have an SSH key set up, you can connect to your IDE:

# Note: Use the IDE ides-hostname, not the web URL
ssh -i ~/.ssh/id_rsa [email protected]

Set up git over SSH in your IDE

Instead of using HTTPS (which requires password authentication), use SSH:

# Configure your IDE's Git to use SSH
git remote set-url origin [email protected]:yourorg/yourrepo.git

# Now push without entering a password
git push origin main

Export public key for other systems

# Show your public key
cat ~/.ssh/id_rsa.pub

# Copy it to GitLab, GitHub, internal systems, etc.

Best Practices

1. One Key Per Device

Create separate keys for each machine:

# Personal laptop
acli ssh-key:create --label "Personal MacBook"

# Work desktop
acli ssh-key:create --label "Work Desktop"

# CI/CD server
acli ssh-key:create --label "Jenkins CI Server"

2. Use Descriptive Labels

# ✓ Good
acli ssh-key:create --label "2024 MacBook Pro - Home"
acli ssh-key:create --label "GitHub Actions CI"

# ✗ Bad
acli ssh-key:create --label "Key 1"

3. Revoke Old Keys

Remove keys you no longer use:

acli ssh-key:delete

4. Protect Your Private Key

# Permissions should be 600 (read/write for owner only)
chmod 600 ~/.ssh/id_rsa

5. Use SSH Agents

macOS:

# Add to ~/.ssh/config
Host *
  AddKeysToAgent yes
  UseKeychain yes

Linux:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa

Advanced: SSH for CI/CD

Generate key for CI/CD pipeline

acli ssh-key:create --label "GitHub Actions CI"

Then:

1. Copy the private key
2. Add it to your CI/CD provider's secrets (GitHub Secrets, GitLab CI/CD Variables, etc.)
3. Use in your CI script

GitHub Actions example:

- name: Deploy to Acquia
  uses: actions/checkout@v2
  env:
    SSH_KEY: ${{ secrets.ACQUIA_SSH_KEY }}
  run: |
    mkdir -p ~/.ssh
    echo "$SSH_KEY" > ~/.ssh/id_rsa
    chmod 600 ~/.ssh/id_rsa
    acli api:environments:code-switch <env-id> main

Related Topics

• [IDE Management](../ide-management/SKILL.md) — Use SSH keys to access IDEs
• [Getting Started](../getting-started/SKILL.md) — Initial setup
• [Troubleshooting](../troubleshooting/SKILL.md)