How the SSH instance key is going to be verified when connecting to Unix (AMI Type) instances.
- check-new-hard: Check the key presented by the instance against the instance console and stores it to check subsequent connections. If the key is not printed on the console, the connection is not trusted. This is the default behavior for new AMIs.
- check-new-soft: Check the key against the instance console and stores it to check subsequent connections. If the key is not printed on the console, the connection is trusted anyway. This is the default behavior for existing AMIs (upgrading from a previous plugin version). This avoids future attacks but cannot guarantee the instance is the right one if a man-in-the-middle attack has already been committed.
- accept-new: Accept the key on first connection and stores it to check subsequent connections. This doesn't try to check the key against the console as the check-new-soft strategy does.
- off: Don't check the host key on any connection.
If the Connect by SSH Process field is checked, the equivalences with the StrictHostKeyChecking flag are:
- check-new-hard = yes
- check-new-soft = accept-new
- accept-new = accept-new
- off = off
Note: With the check-new-hard and check-new-soft strategies you may need to increase the Launch Timeout in seconds because it will now
take until the instance console is ready, which could be several minutes. If the field is blank, it means there is no time-out which will wait indefinitely for the console.