How to create PKA key pair using AWS

Friday 27 May 2022

How to create PKA key pair using AWS

To SSH to our EC2 instance we need to create a Public Key Authentication (PKA) key pair which consist of public and private key. Public key is stored on EC2 AMI (in ~/.ssh/authorized_keys) and this happens on the first boot. Private key needs to be present on the machine where from we want to establish SSH connection. Its path is passed to SSH connect command.

We can create key pair in multiple ways:

locally, on the client machineby using:

OpenSSH commands (see How to generate SSH key pair on Ubuntu | My Public Notepad)
AWS CLI

remotely, by using AWS Management Console

Public key needs to be imported to EC2 instance. One way is via Terraform, by using aws_key_pair and passing its id attribute value as the value of key_name attribute of aws_instance.

How to create PKA key pair using AWS Management Console

At the beginning we have no key pairs created so we click on Create key pair button:

This opens a dialog where we can choose the key pair name, encryption type and private key file format:

When we click on Create key pair button, private key file (named key-pair--ec2--my-app.pem in this example) gets downloaded to our computer automatically and we can see that new key pair is now listed:

If you want the same key pair to work in multiple AWS regions, make sure public key is applied to each region.

How to password-protect the private key file

To password-protect downloaded pem file we can use:

$ ssh-keygen -p -f key-pair--ec2--my-app.pem

If file is readable by anyone, this operation will fail with:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0664 for 'key-pair--ec2--my-app.pem' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Failed to load key key-pair--ec2--my-app.pem: bad permissions

File was indeed readable by everyone:

$ ls -la key-pair--ec2--my-app.pem
-rw-rw-r-- 1 bojan bojan 1678 May 27 11:34 key-pair--ec2--my-app.pem

To rectify the error above, we need to assign read permissions only to the file owner:

$ sudo chmod 400 key-pair--ec2--my-app.pem

$ ls -la key-pair--ec2--my-app.pem
-r-------- 1 bojan bojan 1678 May 27 11:34 key-pair--ec2--my-app.pem

We can now set the password on the file:

$ sudo ssh-keygen -p -f key-pair--ec2--my-app.pem
Enter new passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved with the new passphrase.

Next time this file is used by ssh, you'll be prompted to enter the password.

How to create public key from the private key

It is not possible to download (or see) public key in EC2 Key pairs dashboard (list, as seen on the screenshot above). But it is possible to generate it from the private key (.pem file):

$ ssh-keygen -y -f key-pair--ec2--my-app.pem > key-pair--ec2--my-app.pub
Enter passphrase:

$ cat key-pair--ec2--my-app.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtkH9hzk...0a+UPwPyhD

How to create PKA key pair using AWS CLI

The following command creates the key pair, automatically uploads it to AWS EC2 (it gets listed in AWS Management Console, among EC2 key pairs) and saves private key on the local machine:

$ aws ec2 create-key-pair \

--key-name key-pair--ec2--my-app \

--query 'KeyMaterial' \

--output text > key-pair--ec2--my-app.pem

--query "KeyMaterial" prints the private key material to the output

--output text > my-key-pair.pem saves the private key material in a file with the specified extension. The extension can be either .pem or .ppk.

Additional arguments:

--key-type: rsa (default) or ed25519

--key-format: pem (default) or ppk

Create a key pair using Amazon EC2

---

Both approaches shown above provision EC2 key pairs manually.

If we want to use Terraform the best way is to use 3rd party (e.g. OpenSSH) to create key pairs locally and then use aws_key_pair resource in TF configuration. It is NOT possible importing manually provisioned key pairs into TF state without recreating them. (For more details see Importing infrastructure in Terraform | My Public Notepad)

How to list/find key pairs?

Use ec2 describe-key-pairs. To list all key pairs:

$ aws ec2 describe-key-pairs

To list details for specific key pair:

$ aws ec2 describe-key-pairs --key-names key-pair--ec2--bojan-temp
{
    "KeyPairs": [
        {
            "KeyPairId": "key-0483bced858d885ba",
            "KeyFingerprint": "c2:18:8e:93:ee:52:f9:13:bb:05:9d:94:0c:52:af:9b:ff:6b:d5:3f",
            "KeyName": "key-pair--ec2--bojan-temp",
            "KeyType": "rsa",
            "Tags": []
        }
    ]
}