[Music]
hello i'm roland a cloud support
engineer here at the aws office in
seattle
sometimes customers reach out to us
stating that they have lost their ssh
private key to their amazon ec2 instance
if there are no alternative user
accounts to log into the instance then
you are locked out of your instance
when this happens
there are two ways to restore access to
your ec2 instance
let's get started before starting this
procedure be aware of the following
first this procedure requires a stop and
start of your instance
hence please keep in mind that data in
instant store volumes will be lost
make sure that you backup any data on
the instant store volume that you want
to keep
secondly stopping and starting the
instance changes the public ip address
of the instance
it's a best practice to use an elastic
ip address instead of a public ip
address when routing external traffic to
your instance
method 1
enter user data
create a new key pair
this can be done in two ways
here is the first method
open the amazon ec2 console
select the network and security tab in
the left navigation pane and choose key
pairs
choose create key pair
enter a name for the key pair
for file format choose the format in
which to save the private key
to save the private key in a format that
can be used with open ssh choose pim
to save the private key in a format that
can be used with putty
use ppk
choose create key pair
the private key file will be downloaded
automatically
save the private key file in a safe
place
if you will use an ssh client on a mac
os or linux computer to connect your
linux instance use the following command
to set the permissions of your private
key file so that only you can read it
this is the second method to create a
new keypair
generate a key pair with a third-party
tool of your choice
for example you can use sich keygen
alternatively
java ruby python and many other
programming languages provide standard
libraries that you can use to create a
rsa key pair
save the public key to a local file
for example
tilde forward slash
dot ssh forward slash
my keypair dot pub
note that the file name extension for
this file is not important
save the private key to a local file
that has the dot pem extension
for example
tilde forward slash dot ssh
forward slash my keypair dot pem
please note that it's important to save
the private key file in a safe place
retrieve the public key for the keeper
if you created the key pair in the
amazon ec2 console you can use the ssh
keygen command on your local linux or
mac os computer to retrieve the public
key for the key pair
specify the path where you downloaded
your private key
the command will return the public key
if instead you created the key pair
using ssh keygen the public key will be
in a local file
for example tilde forward slash dot ssh
forward slash my keypair dot pub as
mentioned in method b of the user data
step
after logging in to the aws management
console navigate to the ec2 dashboard
then select the instances tab in the
left navigation pin here you can see
your instance by filtering
using the instance id
select the instance
choose instance state and stop the
instance
select actions
click on instance settings and then
select edit user data
copy the script
to the edit user data dialog box
next replace username field with your
username
such as ec2hyphen user
you can enter the default username
or enter a custom username if one was
previously set up for the instance
replace the public key pair with the
public key retrieved in step 2 of method
b
make sure to enter the entire public key
starting with ssh hyphen rsa
here click on the save button
now select the instance
choose instance state and start the
instance
use the system log to validate that the
cloud init phase is complete and then
connect to the instance via ssh
if needed you can validate that the
public key was replaced please note that
since the script contains a key pair it
is necessary to remove the script from
the user data field
after verifying that you are able to
connect in the previous step
now select the instance
choose instant state and stop the
instance
select actions
click on instance settings and then
select edit user data
delete all the text in the edit user
data dialog box and then choose save
now select the instance
choose instance state and start the
instance
method 2 using aws systems manager
if the instance is a managed instance in
aws systems manager you can use the aws
support hyphen reset access document to
recover your lost keeper
open the aws systems manager console in
your account
then select automation in the left
navigation pane
here you can click on execute
automation
in the automation document section
choose owned by amazon from the list
in the run books list choose the button
in the card for aws support hyphen reset
access
in the execute automation document page
choose simple execution
in the document details section verify
that document version is set to the
highest default version in the input
parameters section specify the following
parameters
for instance id specify the id of the
unreachable instance for subnet id
specify a subnet in an existing vpc in
the same availability zone as the
instance you specified
for ec2 rescue instance type specify an
instance type for the ec2 rescue
instance
choose execute
to monitor the automation progress
choose the running automation and then
choose the steps tab
when the automation is finished choose
the descriptions tab
and then choose view output to view the
results
to view the output of individual steps
choose the steps tab
and then choose view outputs next to a
step
for linux instances the new ssh private
key for your instance is saved encrypted
in a parameter store
the parameter name is
forward slash ec2 rl forward slash open
ssh forward slash instance underscore id
forward slash key you can ssh to the
instance by using this key
note
the automation workflow creates a backup
password enabled amazon machine image
that you may want to
remove to locate these amis
open the amazon ec2 console and then
choose amis from the left navigation
pane
enter the automation execution id in the
search field
method 3
use amazon ec2 instance connect
if your instance is amazon linux 2
2.0
dot 2019
0 6 18 or later
you can use ec2 instance connect to
connect to the instance
open the amazon ec2 console
then select the instances tab in the
left navigation pane select the instance
and choose connect
choose ec2 instance connect
verify the user name and choose connect
to open a terminal window hope you would
now be able to connect to your ec2
instance successfully thanks for
watching and happy cloud computing from
all of us here at aws
[Music]