Terraform local provisioner adds '$'\r to filenames

I am using terraform to create pem files.

This is my code:

resource "tls_private_key" "create_key" {
   algorithm     = "RSA"
   rsa_bits      = 4096

   provisioner "local-exec" {
     interpreter = ["/bin/bash", "-c"]
     command   = <<-EOT
        mkdir keypairs
        cd keypairs
        echo "${tls_private_key.create_key.private_key_pem}"     > "${var.deployment_name}.pem"
        echo "${tls_private_key.create_key.public_key_openssh}"  > "${var.deployment_name}.pem.pub"
    EOT
  }
}

However, this seems to add '$'\r at both the directory name and the file names.
For example, resulting directory would be named: keypairs'$'\r
I am using Terraform with VS Code, running on Ubuntu 20.04 WSL.

Any idea how I can get around this?

Read different sources, tried various things but not found a solution.

Inside the <<-EOT ... EOT section of this configuration Terraform will take the line endings of those lines exactly as they are in your file.

It seems like you've saved this file with Windows-style line endings (CRLF) and so the effective result of that template also has Windows-style line endings. bash seems to be unable to support Windows-style line endings and so the CR part is being interpreted as part of the command line, rather than as part of the line separator.

If you save this .tf file with Unix-style line endings instead (just LF) then those line endings will be included in the result of rendering the template, which I expect will achieve the result you wanted.

Provisioners are a last resort, so here's a different way to get that result using resources:

terraform {
  required_providers {
    tls = {
      source = "hashicorp/tls"
    }
    local = {
      source = "hashicorp/local"
    }
  }
}

resource "tls_private_key" "create_key" {
  algorithm     = "RSA"
  rsa_bits      = 4096
}

resource "local_file" "private_key" {
  filename          = "${var.deployment_name}.pem"
  sensitive_content = tls_private_key.create_key.private_key_pem
}

resource "local_file" "public_key" {
  filename = "${var.deployment_name}.pem.pub"
  content  = tls_private_key.create_key.public_key_openssh
}