Understanding Amazon EC2 Key Pairs: Creation, Formats, and Security
Learn how Amazon EC2 key pairs handle asymmetric authentication for cloud instances. This guide covers RSA vs. ED25519 key types, setting secure SSH permissions, and best practices to safeguard production workloads.
Securing administrative access is critical when provisioning virtual servers in the cloud. Amazon Elastic Compute Cloud (Amazon EC2) relies on asymmetric cryptography using EC2 Key Pairs rather than static passwords to authenticate user access.
What Is an EC2 Key Pair?
An Amazon EC2 key pair consists of two mathematically linked cryptographic keys:
An Amazon EC2 key pair consists of two mathematically linked cryptographic keys:
Public Key: AWS injects this key into the instance during provisioning. For Linux instances, it resides in ~/.ssh/authorized_keys. For Windows instances, AWS uses this public key to encrypt the generated administrator password.
Private Key: Downloaded and stored strictly on your local machine. AWS never retains a copy of your private key. If you lose it, AWS cannot recover it for you.
Choosing Key Types and Formats
When provisioning an EC2 key pair, AWS prompts you to select both an algorithm and a file extension:
When provisioning an EC2 key pair, AWS prompts you to select both an algorithm and a file extension:
Cryptographic Algorithms
RSA: The legacy industry standard. Offers broad backwards compatibility with older operating systems, third-party software, and older SSH clients.
RSA: The legacy industry standard. Offers broad backwards compatibility with older operating systems, third-party software, and older SSH clients.
ED25519: A modern elliptic-curve signature system. Provides higher cryptographic strength per bit, shorter key lengths, and faster connection handshakes. Compatible with modern distributions like Amazon Linux 2023, Ubuntu 20.04+, and modern macOS/Windows terminals.
File Formats
.pem (OpenSSH): Standard format for macOS, Linux, and OpenSSH on Windows PowerShell/CMD.
.pem (OpenSSH): Standard format for macOS, Linux, and OpenSSH on Windows PowerShell/CMD.
.ppk (PuTTY Private Key): Native format required when using the standalone PuTTY GUI client on Windows.
Creating an EC2 Key Pair
Method 1: AWS Management Console
Open the Amazon EC2 Console.
Method 1: AWS Management Console
Open the Amazon EC2 Console.
In the navigation sidebar under Network & Security, choose Key Pairs.
Select Create key pair.
Enter a meaningful Name (for example, prod-web-key).
Choose your Key pair type (RSA or ED25519) and Private key file format (.pem or .ppk).
Click Create key pair. Your browser will immediately download the private key. Store it in a secure directory.
Method 2: AWS CLI
You can also create and write the key pair directly to your local .ssh directory:
You can also create and write the key pair directly to your local .ssh directory:
Bash
aws ec2 create-key-pair
--key-name prod-web-key
--key-type rsa
--key-format pem
--query "KeyMaterial"
--output text > ~/.ssh/prod-web-key.pem
Connecting via SSH
aws ec2 create-key-pair
--key-name prod-web-key
--key-type rsa
--key-format pem
--query "KeyMaterial"
--output text > ~/.ssh/prod-web-key.pem
Connecting via SSH
- Set File Permissions
OpenSSH terminates connections if the private key file is overly permissive. Restrict access so only your user can read it:
Bash
chmod 400 ~/.ssh/prod-web-key.pem
(On Windows, manage file security via Properties > Security > Advanced to remove inherited permissions and grant Full Control only to your user account).
chmod 400 ~/.ssh/prod-web-key.pem
(On Windows, manage file security via Properties > Security > Advanced to remove inherited permissions and grant Full Control only to your user account).
- Run the SSH Command
Connect using your private key and the public IPv4 address or DNS of your instance:
Bash
ssh -i ~/.ssh/prod-web-key.pem <username>@<instance-public-ip>
Default Usernames by Distribution:
ssh -i ~/.ssh/prod-web-key.pem <username>@<instance-public-ip>
Default Usernames by Distribution:
Amazon Linux 2 / Amazon Linux 2023: ec2-user
Ubuntu: ubuntu
Debian: admin
CentOS / RHEL: centos or ec2-user
Security Best Practices
Avoid Universal Shared Keys: Do not share a single key pair across an entire engineering team. Generate dedicated credentials per team member or workload.
Avoid Universal Shared Keys: Do not share a single key pair across an entire engineering team. Generate dedicated credentials per team member or workload.
Prevent Git Leaks: Add *.pem and *.ppk to your global ~/.gitignore file to ensure secrets never get committed to source control.
Import Local Keys: For regulated environments, generate keys on your hardware security module (HSM) or local machine using ssh-keygen, then import only the public key into AWS via Actions > Import key pair.
Transition to AWS Systems Manager (SSM): For enhanced enterprise security, consider using AWS Systems Manager Session Manager. SSM allows interactive shell access via IAM roles without managing local private key files or opening port 22 in your Security Groups.
Cover Image Recommendation
Use a clean 1200px x 675px graphic representing cloud architecture, SSH security, or compute infrastructure (e.g., EC2 icon alongside a security lock or key graphic with AWS dark/orange tones, without overlay text).
Use a clean 1200px x 675px graphic representing cloud architecture, SSH security, or compute infrastructure (e.g., EC2 icon alongside a security lock or key graphic with AWS dark/orange tones, without overlay text).
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article