Before you copy

Your account.
Your paths. Your lab.

A recipe can say “use your house key,” but it cannot know where you keep it. Pick your own values, then use them consistently.

Sample names are labels, not live resources

contoso-infra-code, contoso-container and contoso are fictional resource, project and login names. You can keep them for a fresh isolated lab if available, or rename them consistently in the instructions, Terraform and Ansible. Globally unique storage names need your own random suffix; the shown suffix is not reserved for you.

example.com and lab.example.com illustrate DNS only. They are reserved documentation domains, not domains you can deploy to. Wherever the DNS lab says YOUR-OWNED-DOMAIN, use a domain you own and are authorized to administer. Do not use GuidewellCloud.com, contoso.com or domain.com as your actual lab target.

Some values are real requirements, not filler: AWS Ubuntu's default user is ubuntu, service ports and module names have meaning, and provider APIs expect valid regions, subscriptions and projects.

Choose the key you actually use

The private key is the secret file. Its matching .pub file is the public half you install on the cloud server. Never upload the private key to the portal or put it in a repository. Verify the server fingerprint independently before accepting its host key.

Native PowerShell: inspect and connect

$env:USERPROFILE finds the current Windows user's home directory. This sample sets a path; it does not create a key. Edit it to the existing private key that matches your VM. A filename such as id_ed25519 or my-lab.pem may be valid instead.

PowerShell · your existing private key

$LabSshKey = Join-Path $env:USERPROFILE '.ssh\contoso_aws'
$LabServerIp = 'REPLACE-WITH-YOUR-SERVER-IP'
$LabUser = 'ubuntu' # For Azure/Google, use the username you configured.
if (-not (Test-Path -LiteralPath $LabSshKey -PathType Leaf)) {
  throw 'Key not found. Set $LabSshKey to your actual private-key file.'
}
# Verify the server fingerprint first, then connect:
ssh -i "$LabSshKey" "$LabUser@$LabServerIp"

If your key lives elsewhere, use an absolute path such as $LabSshKey = 'D:\Lab Keys\my-lab.pem'. Quotes preserve spaces. Do not copy a different user's C:\Users\... path. Windows OpenSSH must be installed; follow Microsoft's instructions if the command is unavailable.

Our complete Terraform + Ansible labs use Ubuntu in WSL. WSL has a different home directory and may have different keys from native Windows. Run the lab's key creation and tools there. PowerShell variables and Windows paths are not automatically available in Bash. Do not weaken private-key permissions to bridge the environments.

Ubuntu or Windows Ubuntu/WSL: inspect and connect

$HOME finds the current Linux/WSL user's home directory. Choose the actual private key created by your server lab. This sample only selects an existing key.

Bash · your existing private key

LAB_SSH_KEY="$HOME/.ssh/contoso_aws" # Edit to YOUR existing key.
LAB_SERVER_IP='REPLACE-WITH-YOUR-SERVER-IP'
LAB_USER='ubuntu' # Azure/Google sample account: contoso.
if [ -f "$LAB_SSH_KEY" ]; then
  # Verify the server fingerprint first, then connect:
  ssh -i "$LAB_SSH_KEY" "$LAB_USER@$LAB_SERVER_IP"
else
  printf '%s\n' 'Key not found. Correct LAB_SSH_KEY before connecting.'
fi

A custom location also works: LAB_SSH_KEY='/home/your-user/Lab Keys/my-lab-key'. Use your real username and path; keep the quotes. In a new terminal, set the variable again. The server guides show how to create a separate passphrase-protected key without overwriting an existing pair.

The -i option explicitly selects the identity file. A file not found error is a local path problem; opening more firewall ports will not fix it. See the OpenSSH manual.

Terraform reads the public half

Inside the same Ubuntu/WSL environment where the key was created, run:

Ubuntu / WSL · locate the matching public key

realpath "${LAB_SSH_KEY:?Set LAB_SSH_KEY to your private-key path}.pub"

Paste the resulting absolute path into terraform.tfvars, replacing the entire path below. HCL does not expand Bash's $LAB_SSH_KEY; do not paste the variable name as the path.

terraform.tfvars · replace this example path

public_key_path = "/REPLACE/WITH/YOUR/ABSOLUTE/PUBLIC-KEY-PATH.pub"

The provided recipes read file(pathexpand(var.public_key_path)). The file must exist on the machine running Terraform. If you intentionally run Terraform natively on Windows, use its local public-key path with forward slashes, for example C:/Users/YOUR-USER/.ssh/YOUR-KEY.pub. This does not change where Ansible runs.

Ansible uses the private half

Inside Ubuntu/WSL, run realpath "$LAB_SSH_KEY" and replace the quoted private-key placeholder in the downloaded inventory. Also replace the current server IP and configured login name.

inventory.ini · AWS Ubuntu example, replace IP and path

[lab]
YOUR-SERVER-IP ansible_user=ubuntu ansible_ssh_private_key_file="/REPLACE/WITH/YOUR/ABSOLUTE/PRIVATE-KEY-PATH"

For the fresh Azure/Google recipes, ansible_user=contoso matches the account those recipes create. If your VM has another username, use that actual username. A private-key filename may end in .pem or have no extension; it must not be the .pub file.

An INI inventory does not expand $LAB_SSH_KEY. Put the actual Linux/WSL absolute path there, keep quotes around paths with spaces, and keep the inventory private. Unlock a passphrase-protected key with ssh-add "$LAB_SSH_KEY" in an authorized running SSH-agent session. Test normal SSH first, then the Ansible ping from the relevant lab.

Replace the other personalized values too

Shown value	Replace with
YOUR-SERVER-IP	The current public IP of your authorized lab, from its console or Terraform output.
203.0.113.10/32	Your current laptop/router/VPN public IPv4 plus /32. The shown address is documentation-only.
YOUR-SUBSCRIPTION-ID / YOUR-PROJECT-ID	Your intended sandbox identifiers, not someone else's account.
contoso AWS profile	The local authorized profile you configured; use the same name in login, CLI and Terraform sessions.
Sample bucket/account suffix	Your own permitted globally unique name, used consistently in Terraform, policies, CLI and playbooks.
YOUR-REVIEWED-DIGEST / VERSION	An exact inspected image digest or package version, not a value invented by the tutorial.

A Copy button copies the snippet, not your personal configuration. Commands with placeholders are deliberately not ready to deploy until you supply and review those values.

Already built an earlier version?

Do not apply renamed samples to existing infrastructure blindly. Keep the original resource names, usernames, bucket names, key paths and Terraform state for an existing lab. Resource-name changes can cause replacements, new charges or access loss. Folder, profile and username changes must also be deliberate. Either continue using your current values or clean up the old disposable lab using its original configuration and state before starting a fresh copy. Never delete state to “start over.”

AWS server · Azure server · Google Cloud server · DNS lab

Your account.Your paths. Your lab.