eos_user

Experimental. A local account on an Arista EOS switch: its privilege, role, password and SSH key. Settings left unset are left alone. Conn3x won’t demote or delete the account it logs in as.

Experimental. Network devices are new, and this module may change between releases. It’s tested against cEOS-lab 4.37.0F on a local machine, not yet in CI, so try it on a lab switch first.

Use eos_user to keep a switch’s local accounts in your circuit: who exists, with what role and privilege, which SSH key, and a password that never lands in state. Onboarding an engineer is a step; offboarding is deleting it.

Example usage

An operator who logs in with a key only:

step "alice" {
  eos_user {
    name    = "alice"
    role    = "network-operator"
    ssh_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPqYlxRpTzmq5d0Xgq9Fh0oQn0vMZ8b7T5w1P8kJZx2Q alice@laptop"
  }
}

An admin with a password. Give it from an ephemeral variable, so it stays out of state and plan files:

step "breakglass" {
  eos_user {
    name        = "breakglass"
    privilege   = 15
    role        = "network-admin"
    password_wo = "use-an-ephemeral-variable-here"
  }
}

Arguments

Name	Type	Required	Description
name	string	Yes	The user name.
on_remove	string	No	“delete” (default) removes the account when the step goes, as with every step that grants access; “forget” leaves it.
password_wo	string	No	Write-only: the password, sent to the switch and never kept in state. The switch stores it as a salted hash, so Conn3x can only tell that a password is set; a new value plans a change through password_hmac. Unset leaves the account’s password alone, and a new account gets none (nopassword), for SSH keys only.
privilege	number	No	0 to 15. Conn3x’s own login needs 15.
role	string	No	A role, such as network-admin or network-operator.
ssh_key	string	No	One public key line, such as “ssh-ed25519 AAAA… alice@laptop”. “” removes the account’s key.

Read-only attributes

Conn3x sets these; reference them as conn3x_eos_user.<circuit>__<step>["<host>"].<name>.

Name	Type	Description
in_sync	bool	Whether the account matched at the last refresh.
password_hmac	string	An HMAC of password_wo, keyed outside state, so a new password plans a change.
revision	string	Changes each time Conn3x changes this on the host. Handlers watch it.

A step lowers to the conn3x_eos_user resource, one instance per host, and connects with its circuit’s ssh block.

How it works

EOS stores a password as a salted hash, so Conn3x can only tell that an account has one, never which. It keeps an HMAC of password_wo in password_hmac, keyed outside state, and a new password plans a change through it. Changing the role or privilege keeps the password as it is on the switch. Leave password_wo unset to leave the password alone; a new account then gets none (nopassword), for key-only logins. A password can’t hold spaces, since the EOS CLI would read the rest as more of the command.

Passwords and their hashes are masked in every log line and error Conn3x writes, the session diff included. OpenTofu itself logs its command line, so pass a password through a variable file or TF_VAR_, not -var.

Conn3x won’t lower the privilege or change the role of the account it logs in as, and won’t delete it.

Removal

on_remove defaults to "delete": removing the step deletes the account, as with every step that grants access. Set "forget" to leave it.