AWS EC2 Key Pair Management

TL;DR

Keep your AWS EC2 key pairs secure and organised by following these best practices: use SSH keys instead of passwords, store private keys securely (never in public repositories!), rotate keys regularly, restrict IAM permissions, and automate key management where possible.

1. Understand Key Pairs

AWS EC2 uses key pairs to securely connect to your instances. A key pair consists of a public key (stored by AWS) and a private key (held only by you). Think of it like a digital lock and key.

• Public Key: This is safe to share; it’s used to encrypt data sent *to* your instance.
• Private Key: This must be kept secret! It decrypts the data, allowing you access.

2. Use SSH Keys (Not Passwords)

Always prefer SSH key-based authentication over passwords for EC2 instances. Passwords are much easier to crack.

3. Securely Store Your Private Key

This is the most important step! Compromised private keys mean compromised instances.

• Never commit your private key to source control (e.g., GitHub, GitLab).
• Encrypt your private key at rest. Use tools like OpenSSL or AWS Key Management Service (KMS) for encryption.
• Restrict file permissions on your private key file:

  chmod 400 my_private_key.pem

  This makes it readable only by you.

4. Rotate Your Keys Regularly

Like any security credential, key pairs should be rotated periodically to limit the impact of a potential compromise.

• Frequency: Consider rotating keys every 90-180 days, or more frequently if you have heightened security concerns.
• Process:
  1. Create a new key pair.
  2. Connect to your instances using the new key pair.
  3. Remove access for the old key pair (see step 6).

5. Use IAM Roles and Policies

Control who can create, delete, and use key pairs with AWS Identity and Access Management (IAM).

• Least Privilege: Grant only the necessary permissions to users and roles.
  For example, a developer might need permission to create keys but not delete them.
• Example IAM Policy snippet:

  { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ec2:CreateKeyPair", "ec2:DeleteKeyPair" ], "Resource": "*" } ]}

  (Adjust the Resource to limit access to specific key pairs if possible).

6. Restrict Key Pair Usage

Limit which instances can use a particular key pair.

• Avoid using the same key pair for multiple, unrelated instances. If one instance is compromised, all others using that key are at risk.
• Revoke access when no longer needed: When an instance is terminated or re-imaged, remove its association with the key pair in the EC2 console or via the AWS CLI.

  aws ec2 revoke-security-group-ingress --group-id sg-xxxxxxxxxxxxxxxxx --ip-permissions ...

  (This example revokes security group access; adjust for key pair usage).

7. Automate Key Management

Manual key management is error-prone. Automate where possible.

• AWS Config Rules: Use AWS Config to enforce policies, such as checking that private keys are not stored in public S3 buckets.
• Infrastructure as Code (IaC): Tools like Terraform or CloudFormation can automate key pair creation and rotation.