diff --git a/pkg/apis/kubeone/config/config.go b/pkg/apis/kubeone/config/config.go
index 7dcbbb29a..ea856d063 100644
--- a/pkg/apis/kubeone/config/config.go
+++ b/pkg/apis/kubeone/config/config.go
@@ -24,14 +24,14 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 
-	"k8s.io/apimachinery/pkg/runtime"
-
 	kubeoneapi "github.com/kubermatic/kubeone/pkg/apis/kubeone"
 	kubeonescheme "github.com/kubermatic/kubeone/pkg/apis/kubeone/scheme"
 	kubeonev1alpha1 "github.com/kubermatic/kubeone/pkg/apis/kubeone/v1alpha1"
 	"github.com/kubermatic/kubeone/pkg/apis/kubeone/validation"
 	"github.com/kubermatic/kubeone/pkg/credentials"
 	"github.com/kubermatic/kubeone/pkg/terraform"
+
+	"k8s.io/apimachinery/pkg/runtime"
 )
 
 // SetKubeOneClusterDynamicDefaults sets the dynamic defaults for a given KubeOneCluster object
diff --git a/pkg/terraform/config.go b/pkg/terraform/config.go
index b9a5522fe..b8979e230 100644
--- a/pkg/terraform/config.go
+++ b/pkg/terraform/config.go
@@ -95,17 +95,14 @@ func (c *Config) Apply(cluster *kubeonev1alpha1.KubeOneCluster) error {
 			privateIP = cp.PrivateAddress[i]
 		}
 
-		hosts = append(hosts, kubeonev1alpha1.HostConfig{
-			ID:                i,
-			PublicAddress:     publicIP,
-			PrivateAddress:    privateIP,
-			SSHUsername:       cp.SSHUser,
-			SSHPort:           cp.SSHPort,
-			SSHPrivateKeyFile: cp.SSHPrivateKeyFile,
-			SSHAgentSocket:    cp.SSHAgentSocket,
-			Bastion:           cp.Bastion,
-			BastionPort:       cp.BastionPort,
-		})
+		hosts = append(hosts, newHostConfig(i, publicIP, privateIP, cp))
+	}
+
+	if len(hosts) == 0 {
+		// there was no public IPs available
+		for i, privateIP := range cp.PrivateAddress {
+			hosts = append(hosts, newHostConfig(i, "", privateIP, cp))
+		}
 	}
 
 	if len(hosts) > 0 {
@@ -166,6 +163,20 @@ func (c *Config) Apply(cluster *kubeonev1alpha1.KubeOneCluster) error {
 	return nil
 }
 
+func newHostConfig(id int, publicIP, privateIP string, cp controlPlane) kubeonev1alpha1.HostConfig {
+	return kubeonev1alpha1.HostConfig{
+		ID:                id,
+		PublicAddress:     publicIP,
+		PrivateAddress:    privateIP,
+		SSHUsername:       cp.SSHUser,
+		SSHPort:           cp.SSHPort,
+		SSHPrivateKeyFile: cp.SSHPrivateKeyFile,
+		SSHAgentSocket:    cp.SSHAgentSocket,
+		Bastion:           cp.Bastion,
+		BastionPort:       cp.BastionPort,
+	}
+}
+
 func (c *Config) updateAWSWorkerset(existingWorkerSet *kubeonev1alpha1.WorkerConfig, cfg json.RawMessage) error {
 	var awsCloudConfig machinecontroller.AWSSpec