Amazon EC2 key pairs and Windows instances - Amazon Elastic Compute Cloud
AWS services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with AWS services in China.

Amazon EC2 key pairs and Windows instances

A key pair, consisting of a private key and a public key, is a set of security credentials that you use to prove your identity when connecting to an instance. Amazon EC2 stores the public key, and you store the private key. You use the private key to securely access your instances. Anyone who possesses your private keys can connect to your instances, so it's important that you store your private keys in a secure place.

When you launch an instance, you are prompted for a key pair. If you plan to connect to the instance using RDP, you must specify a key pair. You can choose an existing key pair or create a new one. With Windows instances, you use the private key to obtain the administrator password and then log in using RDP. For more information about connecting to your instance, see Connecting to your Windows instance. For more information about key pairs and Linux instances, see Amazon EC2 key pairs and Linux instances in the Amazon EC2 User Guide for Linux Instances.

Because Amazon EC2 doesn't keep a copy of your private key, there is no way to recover a private key if you lose it. However, there can still be a way to connect to instances for which you've lost the private key. For more information, see Connecting to your Windows instance if you lose your private key.

The keys that Amazon EC2 uses are 2048-bit SSH-2 RSA keys. You can have up to 5,000 key pairs per Region.

Creating or importing a key pair

You can use Amazon EC2 to create a new key pair, or you can import an existing key pair.

Option 1: Create a key pair using Amazon EC2

You can create a key pair using one of the following methods.

New console

To create your key pair

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, under NETWORK & SECURITY, choose Key Pairs.

  3. Choose Create key pair.

  4. For Name, enter a descriptive name for the key pair. Amazon EC2 associates the public key with the name that you specify as the key name. A key name can include up to 255 ASCII characters. It can’t include leading or trailing spaces.

  5. For File format, choose the format in which to save the private key. To save the private key in a format that can be used with OpenSSH, choose pem. To save the private key in a format that can be used with PuTTY, choose ppk.

  6. Choose Create key pair.

  7. The private key file is automatically downloaded by your browser. The base file name is the name you specified as the name of your key pair, and the file name extension is determined by the file format you chose. Save the private key file in a safe place.

    Important

    This is the only chance for you to save the private key file.

Old console

To create your key pair

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, under NETWORK & SECURITY, choose Key Pairs.

  3. Choose Create Key Pair.

  4. For Key pair name, enter a descriptive name for the key pair, and then choose Create. A key name can include up to 255 ASCII characters. It can’t include leading or trailing spaces.

  5. The private key file is automatically downloaded by your browser. The base file name is the name you specified as the name of your key pair, and the file name extension is .pem. Save the private key file in a safe place.

    Important

    This is the only chance for you to save the private key file.

AWS CLI

To create your key pair

  • Use the create-key-pair AWS CLI command as follows to generate the key and save it to a .pem file.

    aws ec2 create-key-pair --key-name my-key-pair --query 'KeyMaterial' --output text > my-key-pair.pem
PowerShell

To create your key pair

Use the New-EC2KeyPair AWS Tools for Windows PowerShell command as follows to generate the key and save it to a .pem file.

PS C:\> (New-EC2KeyPair -KeyName "my-key-pair").KeyMaterial | Out-File -Encoding ascii -FilePath C:\path\my-key-pair.pem

Option 2: Import your own public key to Amazon EC2

Instead of using Amazon EC2 to create your key pair, you can create an RSA key pair using a third-party tool and then import the public key to Amazon EC2. For example, you can use ssh-keygen (a tool provided with the standard OpenSSH installation) to create a key pair. Alternatively, Java, Ruby, Python, and many other programming languages provide standard libraries that you can use to create an RSA key pair.

Requirements

  • The following formats are supported:

    • OpenSSH public key format

    • Base64 encoded DER format

    • SSH public key file format as specified in RFC4716

    • SSH private key file format must be PEM (for example, use ssh-keygen -m PEM to convert the OpenSSH key into the PEM format)

  • Create an RSA key. Amazon EC2 does not accept DSA keys.

  • The supported lengths are 1024, 2048, and 4096.

To create a key pair using a third-party tool

  1. Generate a key pair with a third-party tool of your choice.

  2. Save the public key to a local file. For example, C:\keys\my-key-pair.pub. The file name extension for this file is not important.

  3. Save the private key to a different local file that has the .pem extension. For example, C:\keys\my-key-pair.pem. Save the private key file in a safe place. You'll need to provide the name of your key pair when you launch an instance and the corresponding private key each time you connect to the instance.

After you have created the key pair, use one of the following methods to import your key pair to Amazon EC2.

New console

To import the public key

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, choose Key Pairs.

  3. Choose Import key pair.

  4. For Name, enter a descriptive name for the key pair. The name can include up to 255 ASCII characters. It can’t include leading or trailing spaces.

  5. Either choose Browse to navigate to and select your public key, or paste the contents of your public key into the Public key contents field.

  6. Choose Import key pair.

  7. Verify that the key pair you imported appears in the list of key pairs.

Old console

To import the public key

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, under NETWORK & SECURITY, choose Key Pairs.

  3. Choose Import Key Pair.

  4. In the Import Key Pair dialog box, choose Browse, and select the public key file that you saved previously. Enter a name for the key pair in the Key pair name field, and choose Import. The name can include up to 255 ASCII characters. It can’t include leading or trailing spaces.

  5. Verify that the key pair you imported appears in the list of key pairs.

AWS CLI

To import the public key

Use the import-key-pair AWS CLI command.

To verify that the key pair was imported successfully

Use the describe-key-pairs AWS CLI command.

PowerShell

To import the public key

Use the Import-EC2KeyPair AWS Tools for Windows PowerShell command.

To verify that the key pair was imported successfully

Use the Get-EC2KeyPair AWS Tools for Windows PowerShell command.

Tagging a key pair

To help categorize and manage your existing key pairs, you can tag them with custom metadata. For more information about how tags work, see Tagging your Amazon EC2 resources.

You can view, add, and delete tags using the new console and the command line tools.

New console

To view, add, or delete a tag for an existing key pair

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, choose Key Pairs.

  3. Select a key pair, and then choose Actions, Manage tags.

  4. The Manage tags section displays any tags that are assigned to the key pair.

    • To add a tag, choose Add tag, and then enter the tag key and value. You can add up to 50 tags per key pair. For more information, see Tag restrictions.

    • To delete a tag, choose Remove next to the tag that you want to delete.

  5. Choose Save changes.

AWS CLI

To view key pair tags

Use the describe-tags AWS CLI command. In the following example, you describe the tags for all of your key pairs.

C:\> aws ec2 describe-tags --filters "Name=resource-type,Values=key-pair"
{ "Tags": [ { "Key": "Environment", "ResourceId": "key-0123456789EXAMPLE", "ResourceType": "key-pair", "Value": "Production" }, { "Key": "Environment", "ResourceId": "key-9876543210EXAMPLE", "ResourceType": "key-pair", "Value": "Production" }] }

To describe the tags for a specific key pair

Use the describe-key-pairs AWS CLI command.

C:\> aws ec2 describe-key-pairs --key-pair-ids key-0123456789EXAMPLE
{ "KeyPairs": [ { "KeyName": "MyKeyPair", "KeyFingerprint": "1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f", "KeyPairId": "key-0123456789EXAMPLE", "Tags": [ { "Key": "Environment", "Value": "Production" }] }] }

To tag an existing key pair

Use the create-tags AWS CLI command. In the following example, the existing key pair is tagged with Key=Cost-Center and Value=CC-123.

C:\> aws ec2 create-tags --resources key-0123456789EXAMPLE --tags Key=Cost-Center,Value=CC-123

To delete a tag from a key pair

Use the delete-tags AWS CLI command. For examples, see Examples in the AWS CLI Command Reference.

PowerShell

To view key pair tags

Use the Get-EC2Tag command.

To describe the tags for a specific key pair

Use the Get-EC2KeyPair command.

To tag an existing key pair

Use the New-EC2Tag command.

To delete a tag from a key pair

Use the Remove-EC2Tag command.

Retrieving the public key for your key pair

On your local Windows computer, you can use PuTTYgen to get the public key for your key pair.

Start PuTTYgen and choose Load. Select the .ppk or .pem file. PuTTYgen displays the public key under Public key for pasting into OpenSSH authorized_keys file. You can also view the public key by choosing Save public key, specifying a name for the file, saving the file, and then opening the file.

Retrieving the public key for your key pair through instance metadata

The public key that you specified when you launched an instance is also available to you through its instance metadata. To view the public key that you specified when launching the instance, use the following command from your instance:

PS C:\> Invoke-RestMethod -uri http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

The following is an example output.

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClKsfkNkuSevGj3eYhCe53pcjqP3maAhDFcvBS7O6V hz2ItxCih+PnDSUaw+WNQn/mZphTk/a/gU8jEzoOWbkM4yxyb/wB96xbiFveSFJuOp/d6RJhJOI0iBXr lsLnBItntckiJ7FbtxJMXLvvwJryDUilBMTjYtwB+QhYXUMOzce5Pjz5/i8SeJtjnV3iAoG/cQk+0FzZ qaeJAAHco+CY/5WrUBkrHmFJr6HcXkvJdWPkYQS3xqC0+FmUZofz221CBt5IMucxXPkX4rWi+z7wB3Rb BQoQzd8v7yeb7OzlPnWOyN0qFU0XA246RA8QFYiCNYwI3f05p6KLxEXAMPLE my-key-pair

If you change the key pair that you use to connect to the instance, we don't update the instance metadata to show the new public key. Instead, the instance metadata continues to show the public key for the key pair that you specified when you launched the instance. For more information, see Retrieving instance metadata.

Identifying the key pair that was specified at launch

When you launch an instance, you are prompted for a key pair. If you plan to connect to the instance using RDP, you must specify a key pair.

To identify the key pair that was specified at launch

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, choose Instances, and then select your instance.

  3. On the Description tab, the Key pair name field displays the name of the key pair that you specified when you launched the instance. The value of the Key pair name does not change even if you change the public key on the instance, or add key pairs.

(Optional) Verifying your key pair's fingerprint

On the Key Pairs page in the Amazon EC2 console, the Fingerprint column displays the fingerprints generated from your key pairs. AWS calculates the fingerprint differently depending on whether the key pair was generated by AWS or a third-party tool. If you created the key pair using AWS, the fingerprint is calculated using an SHA-1 hash function. If you created the key pair with a third-party tool and uploaded the public key to AWS, or if you generated a new public key from an existing AWS-created private key and uploaded it to AWS, the fingerprint is calculated using an MD5 hash function.

You can use the SSH2 fingerprint that's displayed on the Key Pairs page to verify that the private key you have on your local machine matches the public key stored in AWS. From the computer where you downloaded the private key file, generate an SSH2 fingerprint from the private key file. The output should match the fingerprint that's displayed in the console.

If you created your key pair using AWS, you can use the OpenSSL tools to generate a fingerprint as shown in the following example.

C:\> openssl pkcs8 -in path_to_private_key -inform PEM -outform DER -topk8 -nocrypt | openssl sha1 -c

If you created a key pair using a third-party tool and uploaded the public key to AWS, you can use the OpenSSL tools to generate the fingerprint as shown in the following example.

C:\> openssl rsa -in path_to_private_key -pubout -outform DER | openssl md5 -c

If you created an OpenSSH key pair using OpenSSH 7.8 or later and uploaded the public key to AWS, you can use ssh-keygen to generate the fingerprint as shown in the following example.

C:\> ssh-keygen -ef path_to_private_key -m PEM | openssl rsa -RSAPublicKey_in -outform DER | openssl md5 -c

Connecting to your Windows instance if you lose your private key

When you connect to a newly launched Windows instance, you decrypt the password for the Administrator account using the private key for the key pair that you specified when you launched the instance.

If you lose the Administrator password and you no longer have the private key, you must reset the password or create a new instance. For more information, see Resetting a Lost or Expired Windows Administrator Password. For steps to reset the password using an AWS Systems Manager document, see Reset Passwords and SSH Keys on Amazon EC2 Instances in the AWS Systems Manager User Guide.

Deleting your key pair

When you delete a key pair, you are only deleting the Amazon EC2 copy of the public key. Deleting a key pair doesn't affect the private key on your computer or the public key on any instances that already launched using that key pair. You can't launch a new instance using a deleted key pair, but you can continue to connect to any instances that you launched using a deleted key pair, as long as you still have the private key (.pem) file.

If you're using an Auto Scaling group (for example, in an Elastic Beanstalk environment), ensure that the key pair you're deleting is not specified in your launch configuration. Amazon EC2 Auto Scaling launches a replacement instance if it detects an unhealthy instance; however, the instance launch fails if the key pair cannot be found.

You can delete a key pair using one of the following methods.

New console

To delete your key pair

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, choose Key Pairs.

  3. Select the key pair to delete and choose Delete.

  4. In the confirmation field, enter Delete and then choose Delete.

Old console

To delete your key pair

  1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

  2. In the navigation pane, under NETWORK & SECURITY, choose Key Pairs.

  3. Select the key pair and choose Delete.

  4. When prompted, choose Yes.

AWS CLI

To delete your key pair

Use the delete-key-pair AWS CLI command.

PowerShell

To delete your key pair

Use the Remove-EC2KeyPair AWS Tools for Windows PowerShell command.