Amazon EC2 keypair recovery

user_468253 0
Viewed 70726

I need to know of any way to access a running instance in Amazon EC2.

  • I DON'T have the original keypair ".pem" file
  • I DO have access to the aws management console
  • Terminating/rebooting is not feasible

the closest to my question I have found was this but I hope things have changed since.

is there any way to download that pem file or assign a new keypair?

amazon-ec2
4 Answers

The keypairs can only be downloaded once from Amazon, presumably for security reasons. What you could do, is assign one of your Elastic IP's to the instance and route traffic through that normally. Snapshot the instance and bring up a duplicate with a new Keypair. Switch the Elastic IP over to the new instance. This is not particularly elegant, but is much less downtime than a full shutdown.

Note: If you assign the Elastic IP to the instance, it will override the current public IP, so you will have to make sure to update DNS as well.

user_5464190

When you are setting up your AMI's going forward, setup cloud-init. On boot this will pull down the user data and process it accordingly. Therefore you can insert something like the following into the user data box while the AMI is stopped:

mkdir -p /root/.ssh/

cat > /root/.ssh/keyname.pub <<EOF_PUB
ssh-rsa yourkeydata== keyname@wherever
EOF_PUB

cat /root/.ssh/keyname.pub >> /root/.ssh/authorized_keys;

Again though, if your cloud-init packages are not installed and running this will be ineffective. I have on more than one occasion had to recover locked out AMI's from developers who don't save their keys. This is a godsend.

user_12529590
Related