Key Pairs and Authentication
How to Access an EC2 Instance?
To connect to an EC2 instance, you need an authentication mechanism. AWS uses SSH key pairs for Linux and passwords for Windows.
┌─────────────────────────────────────────────────────────────┐
│ EC2 AUTHENTICATION │
├─────────────────────────────────────────────────────────────┤
│ │
│ LINUX WINDOWS │
│ ───── ─────── │
│ │
│ ┌──────────┐ ┌──────────┐ │
│ │ SSH Key │ │ Password │ │
│ │ (RSA/ED) │ │ │ │
│ └────┬─────┘ └────┬─────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────┐ ┌──────────┐ │
│ │ SSH │ │ RDP │ │
│ │ Port 22 │ │ Port 3389│ │
│ └────┬─────┘ └────┬─────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────────────────────────────────┐ │
│ │ EC2 Instance │ │
│ └──────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────┘
SSH Key Pairs (Linux)
What is a Key Pair?
A key pair consists of two parts:
┌─────────────────────────────────────────────────────────────┐
│ SSH KEY PAIR │
├─────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ PRIVATE KEY │ │
│ │ (my-key.pem) │ │
│ │ │ │
│ │ • File YOU keep on your computer │ │
│ │ • NEVER share or publish! │ │
│ │ • Used to prove your identity │ │
│ │ • If lost = no more access to the instance │ │
│ │ │ │
│ │ Format: .pem file (Linux/Mac) or .ppk (PuTTY) │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ PUBLIC KEY │ │
│ │ (installed on the instance) │ │
│ │ │ │
│ │ • Automatically installed by AWS at launch │ │
│ │ • Stored in ~/.ssh/authorized_keys │ │
│ │ • Can be shared without risk │ │
│ │ • Allows verification of the private key │ │
│ │ │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
│ 🔐 Principle: What is encrypted with the public can │
│ only be decrypted with the corresponding private key │
│ │
└─────────────────────────────────────────────────────────────┘
Analogy: Padlock and Key
┌─────────────────────────────────────────────────────────────┐
│ ANALOGY: PADLOCK AND KEY │
├─────────────────────────────────────────────────────────────┤
│ │
│ PUBLIC KEY = OPEN PADLOCK │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ 🔓 You can give open padlocks to everyone. │ │
│ │ They can lock boxes with them, but not open them.│ │
│ └─────────────────────────────────────────────────────┘ │
│ │
│ PRIVATE KEY = UNIQUE KEY TO THE PADLOCK │
│ ┌─────────────────────────────────────────────────────┐ │
│ │ 🔑 Only YOU have the key that opens these padlocks. │ │
│ │ If you lose it, no one can open the boxes. │ │
│ └─────────────────────────────────────────────────────┘ │
│ │
│ APPLICATION: │
│ • EC2 Instance = Box locked with your padlock │
│ • SSH Connection = Using your key to enter │
│ │
└─────────────────────────────────────────────────────────────┘
Create a Key Pair
Via the AWS Console
1. EC2 → Network & Security → Key Pairs
2. Create key pair
3. Name: "my-ec2-key"
4. Type: RSA (or ED25519)
5. Format: .pem (Linux/Mac) or .ppk (PuTTY/Windows)
6. Create key pair
7. ⬇️ The .pem file is automatically downloaded
8. ⚠️ KEEP IT SAFE! AWS does not store it!
Via AWS CLI
# Create a key pair
aws ec2 create-key-pair \
--key-name my-ec2-key \
--query 'KeyMaterial' \
--output text > my-ec2-key.pem
# Set permissions (Linux/Mac)
chmod 400 my-ec2-key.pem
Connect via SSH
Linux / macOS
# Basic syntax
ssh -i /path/to/key.pem user@public-ip
# Concrete example
ssh -i ~/Downloads/my-ec2-key.pem ec2-user@52.1.2.3
# Default users according to AMI:
# Amazon Linux, RHEL : ec2-user
# Ubuntu : ubuntu
# Debian : admin or debian
# CentOS : centos or ec2-user
# SUSE : ec2-user or root
Windows with PuTTY
1. Download PuTTY and PuTTYgen
2. Convert .pem to .ppk:
• Open PuTTYgen
• Load → Select the .pem
• Save private key → my-key.ppk
3. Connect with PuTTY:
• Host Name: ec2-user@52.1.2.3
• Connection → SSH → Auth → Browse → my-key.ppk
• Open
Windows with OpenSSH (Windows 10+)
# Windows 10/11 has built-in SSH
ssh -i C:\Users\me\my-ec2-key.pem ec2-user@52.1.2.3
Common Errors
Error: "Permission denied"
┌─────────────────────────────────────────────────────────────┐
│ ERROR: PERMISSION DENIED │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message: │
│ Permission denied (publickey,gssapi-keyex,gssapi-with-mic) │
│ │
│ Possible causes: │
│ │
│ 1. Wrong key │
│ → Check it's the correct key pair │
│ │
│ 2. Wrong user │
│ → ec2-user for Amazon Linux, ubuntu for Ubuntu │
│ │
│ 3. Security Group │
│ → Port 22 closed or wrong source IP │
│ │
│ 4. Instance not ready yet │
│ → Wait for status checks to pass │
│ │
└─────────────────────────────────────────────────────────────┘
Error: "Permissions too open"
┌─────────────────────────────────────────────────────────────┐
│ ERROR: PERMISSIONS TOO OPEN │
├─────────────────────────────────────────────────────────────┤
│ │
│ Message: │
│ WARNING: UNPROTECTED PRIVATE KEY FILE! │
│ Permissions 0644 for 'my-key.pem' are too open. │
│ │
│ Solution (Linux/Mac): │
│ chmod 400 my-key.pem │
│ │
│ Explanation: │
│ • 400 = read-only for the owner │
│ • SSH refuses keys readable by others │
│ • Protection against key theft │
│ │
└─────────────────────────────────────────────────────────────┘
Error: "Connection timeout"
┌─────────────────────────────────────────────────────────────┐
│ ERROR: CONNECTION TIMEOUT │
├─────────────────────────────────────────────────────────────┤
│ │
│ Possible causes: │
│ │
│ 1. Security Group │
│ → Port 22 not open │
│ → Your IP is not authorized │
│ │
│ 2. No public IP │
│ → Instance in private subnet │
│ → Elastic IP not attached │
│ │
│ 3. Blocking NACL │
│ → Check subnet network rules │
│ │
│ 4. Instance not running │
│ → Check instance status │
│ │
└─────────────────────────────────────────────────────────────┘
Windows Authentication (RDP)
Retrieve the Password
┌─────────────────────────────────────────────────────────────┐
│ WINDOWS CONNECTION - RDP │
├─────────────────────────────────────────────────────────────┤
│ │
│ 1. Wait 4+ minutes after launch │
│ (Windows needs to generate the password) │
│ │
│ 2. EC2 → Instances → Select the instance │
│ │
│ 3. Actions → Security → Get Windows password │
│ │
│ 4. Upload your .pem file (private key) │
│ │
│ 5. Click "Decrypt Password" │
│ │
│ 6. Copy the displayed password │
│ │
│ 7. Connect with Remote Desktop: │
│ • Address: Public IP of the instance │
│ • User: Administrator │
│ • Password: the decrypted one │
│ │
└─────────────────────────────────────────────────────────────┘
Key Management
Best Practices
┌─────────────────────────────────────────────────────────────┐
│ BEST PRACTICES - SSH KEYS │
├─────────────────────────────────────────────────────────────┤
│ │
│ ✅ TO DO: │
│ │
│ • Use a different key per environment │
│ - dev-key.pem │
│ - staging-key.pem │
│ - prod-key.pem │
│ │
│ • Store keys in a secure place │
│ - Password manager (1Password, etc.) │
│ - Enterprise vault (Vault) │
│ │
│ • Set correct permissions │
│ - chmod 400 on .pem files │
│ │
│ • Use ED25519 keys (more secure than RSA) │
│ │
│ ❌ TO AVOID: │
│ │
│ • Sharing keys via email or Slack │
│ • Committing keys in Git │
│ • Using the same key for everything │
│ • Leaving unused keys │
│ │
└─────────────────────────────────────────────────────────────┘
Alternative: EC2 Instance Connect
AWS offers an alternative to SSH keys: EC2 Instance Connect
┌─────────────────────────────────────────────────────────────┐
│ EC2 INSTANCE CONNECT │
├─────────────────────────────────────────────────────────────┤
│ │
│ SSH connection via AWS console without managing keys │
│ │
│ How to use it: │
│ 1. EC2 → Instances → Select the instance │
│ 2. Connect → EC2 Instance Connect │
│ 3. Connect │
│ 4. A terminal opens in the browser! │
│ │
│ Advantages: │
│ • No key management │
│ • Access from anywhere │
│ • Traceability via CloudTrail │
│ │
│ Disadvantages: │
│ • Requires network access to the instance │
│ • No file transfer (scp) │
│ • Not ideal for automation │
│ │
└─────────────────────────────────────────────────────────────┘
Alternative: AWS Systems Manager Session Manager
┌─────────────────────────────────────────────────────────────┐
│ SESSION MANAGER │
├─────────────────────────────────────────────────────────────┤
│ │
│ SSH connection without open port 22! │
│ │
│ How it works: │
│ • SSM agent installed on the instance │
│ • Connection via AWS Console or CLI │
│ • Goes through AWS APIs, not direct SSH │
│ │
│ Advantages: │
│ • No need to open port 22 │
│ • No SSH key management │
│ • Logs of all sessions │
│ • Access to private instances │
│ │
│ aws ssm start-session --target i-0123456789abcdef0 │
│ │
└─────────────────────────────────────────────────────────────┘
Summary
| Concept | Description |
|---|---|
| Private Key | .pem file to keep secret |
| Public Key | Installed on the instance |
| SSH | Linux connection protocol (port 22) |
| RDP | Windows connection protocol (port 3389) |
| chmod 400 | Correct permissions for private key |
| Instance Connect | Alternative without key management |
Validation Quiz
- What is the difference between a public key and a private key?
- Which user to use for SSH on Amazon Linux?
- Which command sets the correct permissions on a .pem file?
- Why does SSH refuse a key with "too open" permissions?
- How to retrieve the password of a Windows instance?
- Which alternative allows connecting without managing keys?
Next section: Security Groups