SSH access denied after adding user or SSH key in cloud environment
SSH access fails when connecting to an Adobe Commerce on cloud infrastructure environment, even after granting access or adding an SSH key. The environment does not reflect updated access or SSH key changes until deployment completes successfully. To resolve the issue, redeploy the environment to apply access and SSH updates.
Description description
Environment
Adobe Commerce on cloud infrastructure (all supported versions)
Issue/Symptoms
-
An SSH connection fails for a specific Adobe Commerce on cloud infrastructure environment, even after granting access to the project or environment.
-
An SSH connection fails after adding or updating the SSH public key in the account.
-
The following errors appear during the SSH attempt:
code language-none The service doesn't exist or you do not have access to it. Permission denied (publickey). -
An SSH connection works for one environment but fails for another environment within the same project.
Root cause
In Adobe Commerce on cloud infrastructure, adding a user or changing an SSH public key does not apply the change automatically. The target environment must be redeployed successfully for the new SSH access configuration to be installed. If the target environment is not redeployed successfully after the access or SSH key change, SSH access fails with the Permission denied (publickey) error.
Resolution resolution
Follow the steps below to address the issue:
-
Ask a project admin to confirm that the user has the required access level for the target environment.
-
Confirm that the user has added the correct SSH public key to their Adobe Commerce on cloud infrastructure account.
-
If MFA is enabled for SSH access on the project, confirm that the user has completed the required MFA/TFA setup.
-
Ask a project admin to review the deployment history for the affected environment in Cloud Console.
- If user access was recently granted or changed, ask a project admin to redeploy the affected environment so the access change is applied.
- If the SSH public key was recently added or updated, redeploy all active environments so the key is installed.
-
Wait for the redeployment to complete successfully.
-
Retry the SSH connection using the exact SSH command shown for that environment in Cloud Console.
-
If SSH still fails, verify that the local machine is using the private key that matches the public key uploaded to the account.
If SSH still fails after a successful redeployment:
- Verify that you are using the SSH command shown for that environment in the Cloud Console.
- Verify that the local system uses the matching private key associated with the configured SSH public key.
Verify access using the magento-cloud CLI
If you cannot confirm access in Cloud Console, verify your role assignments using the magento-cloud CLI. After installing the CLI and signing in, run magento-cloud user:get.
If you are associated with multiple projects, select the required project when prompted. You can also run the command from a local project directory so the CLI uses the current project automatically. The command returns your project role and environment-type roles. For example:
Current role(s) of User (user@example.com) on Project Name (project_id):Project role: viewerRole on environment type development: [ none] Role on environment type production: [ none] Role on environment type staging: [ none]
In this output:
Project role: viewer indicates view-only project access.Role on environment type ...: [ none]indicates no access to those environment types.- With this combination, the user cannot perform environment actions or use SSH for those environment types.
For Adobe Commerce on cloud infrastructure, only Admin and Contributor roles provide SSH access. Viewer and No access do not.
If the output shows insufficient access, contact a project admin to request the required environment permissions.