How to Connect to Your EC2 Instance Using SSH
Learn how to connect to your AWS EC2 instance using SSH, step by step, including fixing the most common permission and connection errors beginners hit.
Series: AWS Beginners Guide (4 articles)
- …
- 3How to Connect to Your EC2 Instance Using SSH This article
You've launched your first EC2 instance. It's sitting there, running, waiting for you to do something with it. But there's a gap between "my server exists" and "I can actually control it," and that gap is SSH.
If you've never used SSH before, the first attempt can feel unnecessarily intimidating. Permission errors, mysterious key file warnings, a terminal that just hangs. None of it is actually complicated once you understand what's happening underneath. This guide walks through the whole process, plus the handful of errors almost everyone hits on their first try.
What is SSH, Actually?
SSH stands for Secure Shell. It's a protocol that lets you open a secure, encrypted connection from your computer to a remote machine, in this case, your EC2 instance, and control it through a command line as if you were sitting right in front of it.
Instead of a username and password, SSH to EC2 typically relies on a key pair: a public key that lives on the server, and a private key that stays on your own computer. When you connect, your computer proves its identity using the private key, without ever sending a password over the network. This is both more secure and, once set up, faster than typing a password every time.
If you launched your EC2 instance and downloaded a
.pem file during setup, that file is your private key. It's the single most important file in this entire process, so let's talk about it before anything else.Before You Start: Locate Your Key Pair File
When you launched your EC2 instance, AWS either let you create a new key pair or use an existing one. If you created a new one, a
.pem file was downloaded to your computer at that moment, and it cannot be downloaded again later.Common places people lose track of it: the Downloads folder, buried under dozens of other files, or accidentally deleted during a cleanup. Before continuing, locate that file and move it somewhere permanent and organized, like a dedicated
~/.ssh/ folder (Mac/Linux) or a keys folder in your user directory (Windows).If you genuinely cannot find your key pair file and have no backup, there's no way to recover it. Your only option is to create a new key pair and either launch a new instance with it, or replace the key on your existing instance (a more advanced process involving a rescue volume, outside the scope of this guide).
Step 1: Set the Correct Permissions on Your Key File
This step trips up almost every beginner, and it's the number one cause of SSH connection failures.
SSH refuses to use a private key file if its permissions are too open. This is a deliberate security measure. If your key file is readable by anyone else on your system, SSH assumes it might have been tampered with and blocks the connection entirely.
On Mac or Linux, open your terminal and run:
1
chmod 400 /path/to/your-key.pem
This restricts the file so only you can read it, and nobody (including you) can write to it. That's exactly what SSH expects.
On Windows, if you're using PowerShell, the equivalent process is a bit more involved since Windows handles file permissions differently:
1
2
3
icacls.exe your-key.pem /reset
icacls.exe your-key.pem /grant:r "$($env:username):(r)"
icacls.exe your-key.pem /inheritance:r
If you're using WSL (Windows Subsystem for Linux) instead, just use the same
chmod 400 command as Mac/Linux, since WSL behaves like a Linux environment.Step 2: Find Your Instance's Public IP Address
Head to the EC2 console, select your running instance, and look at the instance details panel. You'll need either the Public IPv4 address or the Public IPv4 DNS name, both work for connecting.
Keep in mind: if you haven't set up an Elastic IP, this address changes every time you stop and start your instance. Always grab the current one before connecting, rather than reusing an address from a previous session.
Step 3: Connect Using the SSH Command
With your key permissions set and your instance's IP in hand, open your terminal (or PowerShell/WSL on Windows) and run:
1
ssh -i /path/to/your-key.pem ec2-user@your-instance-public-ip
A few things worth explaining in that command:
-i /path/to/your-key.pemtells SSH which private key to use for authenticationec2-useris the default username for Amazon Linux instances. If you're using Ubuntu, it'subuntuinstead. Other AMIs use different defaults (adminfor Debian,centosfor CentOS), so check your AMI's documentation if you're unsureyour-instance-public-ipis the address you grabbed in Step 2
The first time you connect to a new instance, you'll see a message like this:
1
2
3
The authenticity of host 'xx.xx.xx.xx' can't be established.
ED25519 key fingerprint is SHA256:xxxxxxxxxxxxx.
Are you sure you want to continue connecting (yes/no/[fingerprint])?
This is normal. Type
yes and press enter. SSH is simply confirming, since it's the first time, that it's connecting to the server it expects.If everything is correct, you'll land on a welcome message and a command prompt that now represents your EC2 instance, not your local computer.
You're in. Anything you type now runs on your remote server.
Connecting via Browser Instead (No Terminal Needed)
If you'd rather skip the terminal entirely, AWS also offers EC2 Instance Connect, which opens a browser-based terminal session directly from the console.
- Select your instance in the EC2 console
- Click Connect
- Choose the EC2 Instance Connect tab
- Click Connect
This opens a terminal session in a new browser tab, already authenticated, with no key file handling required on your end. It's a convenient option for quick checks, though most developers eventually move to a terminal-based SSH workflow for daily use, since it integrates better with tools like SCP for file transfers and SSH config files for managing multiple servers.
Common SSH Errors and How to Fix Them
"Permissions 0644 for 'your-key.pem' are too open"
This is the exact issue covered in Step 1. SSH is refusing to use your key because other users on your system could potentially read it. Run
chmod 400 on the file (Mac/Linux/WSL) or the icacls commands shown above (Windows PowerShell)."Connection timed out"
This almost always means your Security Group isn't allowing SSH traffic from your current location, or you're using the wrong IP address.
- Check that your instance's Security Group has an inbound rule allowing port 22 from your IP address (or
0.0.0.0/0if you're testing, though this isn't recommended long-term) - Confirm you're using the current public IP, since it changes on every restart unless you've attached an Elastic IP
- If you're on a restrictive network (some university or office Wi-Fi), outbound SSH traffic may be blocked entirely on that network
"Permission denied (publickey)"
This usually means one of three things: you're using the wrong username (
ec2-user vs ubuntu vs something else), you're pointing to the wrong key file, or the key file doesn't match the one associated with that specific instance. Double-check all three before assuming something more serious is wrong."Host key verification failed"
This happens if you've connected to an IP address before, under a different instance, and your local machine still remembers the old host key. Since EC2 reuses IP addresses across different instances over time, SSH flags the mismatch as a potential security concern. Fix it by removing the stale entry:
1
ssh-keygen -R your-instance-public-ip
Then try connecting again. You'll be prompted to accept the new host key, same as the first connection.
The terminal just hangs with no response
Usually a networking issue rather than an SSH issue specifically. Check that your instance is actually in a "running" state, confirm the Security Group allows your current IP, and verify you don't have a typo in the IP address itself.
Making Future Connections Easier
Typing the full SSH command with the key path every time gets old fast. A simple fix is creating an SSH config file at
~/.ssh/config on your local machine:1
2
3
4
Host my-ec2-server
HostName your-instance-public-ip
User ec2-user
IdentityFile /path/to/your-key.pem
Once this is set up, connecting is as simple as:
1
ssh my-ec2-server
This becomes especially useful once you're managing more than one instance, since each one can have its own short, memorable alias instead of a long command you have to retype or dig out of your notes every time.
Where to Go From Here
Once you're comfortable connecting over SSH, the natural next steps are setting up an Elastic IP so your instance's address stops changing every restart, learning to transfer files between your computer and your instance using
scp or rsync, and getting familiar with basic Linux commands if you're newer to server administration in general.SSH feels like a hurdle the first time, but it becomes second nature within a few sessions. Once it clicks, it's genuinely one of the most satisfying parts of working with cloud servers: typing a single command and instantly having full control over a machine running somewhere on the other side of the world.
Run into an SSH error that isn't covered here? Drop a comment with the exact message you're seeing; happy to help troubleshoot.
Series: AWS Beginners Guide (4 articles)
- …
- 3How to Connect to Your EC2 Instance Using SSH This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article