Careeroza

Key Pairs

AWS Key Pairs are the primary mechanism used to secure administrative remote access to Amazon EC2 instances. They implement asymmetric cryptography to securely authenticate your identity when establishing a Secure Shell (SSH) connection to a Linux server or decrypting the administrator password for a Windows server.


By utilizing public-key cryptography, AWS eliminates the security risks associated with distributing, managing, and rotating traditional text-based passwords across cloud infrastructure.


The Cryptographic Mechanics

An AWS Key Pair consists of two mathematically linked components that work together to validate your identity:

  • The Public Key: This is the non-secret half of the cryptographic pair. When you launch an EC2 instance and assign a key pair to it, AWS automatically copies this public key into the virtual machine's internal filesystem. On Linux instances, it is appended to the root configuration file located at ~/.ssh/authorized_keys.

  • The Private Key: This is the strictly confidential half of the pair. When a new key pair is generated, AWS hands the private key file directly to your web browser as a local download (using a .pem or .ppk file extension). AWS does not keep a copy of this private key on its infrastructure. If you lose this file, AWS cannot re-generate it or send you a backup clone.


When you attempt to connect to an EC2 instance via SSH, your local machine uses your private key to sign a challenge token. The instance reads the signature, verifies it using the pre-installed public key, and grants terminal access only if the mathematical relationship matches perfectly.


File Formats and OS Compatibility

When generating a key pair via the AWS Management Console or CLI, you must select the file format based on the SSH client software you plan to use:

  • .pem (Privacy-Enhanced Mail): The industry standard format. Select this if you are connecting from macOS, Linux, or modern Windows terminals using OpenSSH via the native command line.

  • .ppk (PuTTY Private Key): A proprietary key format designed specifically for the legacy Windows SSH client tool, PuTTY.


Supported Encryption Algorithms

AWS allows you to choose between two underlying mathematical hashing algorithms when creating a key pair:

  • RSA: The traditional, widely compatible cryptographic standard. It uses longer key lengths (typically 2048-bit) and is supported by almost all legacy and modern operating system images.

  • ED25519: A modern, highly efficient elliptic-curve signing algorithm. It offers significantly faster cryptographic operations and a much smaller key footprint while providing equal or greater security than standard RSA. Note: Windows instances and certain legacy Linux AMIs do not support ED25519.


Step-by-Step Linux Connection Workflow

Connecting to a Linux EC2 instance using a downloaded private key requires precise handling of local file permissions. OpenSSH clients will explicitly reject connection attempts if your private key file is exposed to other local system users.

1. Secure the Key File Permissions Before running the connection string, you must restrict read permissions on your downloaded .pem file using the terminal command line:

Bash
chmod 400 your-aws-key.pem

This command enforces user-read-only access (-r--------), which satisfies the strict security checks of the local OpenSSH client.


2. Execute the Connection String Locate the public IPv4 address of your running EC2 instance from the AWS console and run the following command to initialize the remote shell:

Bash
ssh -i "your-aws-key.pem" ubuntu@your-ec2-public-ip

(Replace ubuntu with the default administrative user account tied to your specific AMI—e.g., ec2-user for Amazon Linux, admin for Debian, or centos for CentOS).

The Windows Instance Workflow

Windows operating systems do not natively use SSH for remote administration; they rely on the Remote Desktop Protocol (RDP), which requires a standard username and password to log in. AWS bridges this gap by using your key pair to securely pass those credentials:

  1. When a Windows instance boots up for the first time, AWS's internal initialization script generates a random, complex password for the local Administrator account.

  2. The script encrypts this plaintext password using the public key assigned during the instance launch phase and caches the encrypted string inside the AWS metadata layer.

  3. To log in, you navigate to the EC2 console, select Connect, and click Get Password.

  4. The console will prompt you to browse for or paste the contents of your local private key (.pem) file.

  5. Your web browser processes the decryption locally on your workstation, matching your private key against the encrypted metadata string, and displays the plaintext password on your screen so you can log into your RDP client.


Modern Alternatives: AWS Systems Manager Session Manager

While key pairs remain a foundational security asset, managing, distributing, and tracking physical .pem files across large engineering teams introduces operational overhead and risk (e.g., keys being accidentally committed to public git repositories).

To mitigate this, modern cloud architectures frequently adopt AWS Systems Manager Session Manager as a replacement for traditional key-pair-based SSH connections.

Session Manager allows you to open a secure terminal shell directly inside your AWS web console or via the AWS CLI without needing to open inbound port 22 in your Security Groups, attach public IP addresses to your instances, or manage physical cryptographic key files on your desktop. Access governance is handled entirely through standard IAM policies and logged end-to-end via AWS CloudTrail for comprehensive compliance auditing.