HIGH
Source
Trivy
ID
AVD-DIG-0004

SSH Keys are the preferred way to connect to your droplet, no keys are supplied

When working with a server, you’ll likely spend most of your time in a terminal session connected to your server through SSH. A more secure alternative to password-based logins, SSH keys use encryption to provide a secure way of logging into your server and are recommended for all users.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Use ssh keys for login

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
data "digitalocean_ssh_key" "terraform" {
  name = "myKey"
}

resource "digitalocean_droplet" "good_example" {
  image    = "ubuntu-18-04-x64"
  name     = "web-1"
  region   = "nyc2"
  size     = "s-1vcpu-1gb"
  ssh_keys = [data.digitalocean_ssh_key.myKey.id]
}