- You have many EC2 instances running production code
- Access to those instances is using a passphrase-protected key
- A member of your operations team who has access to the key leaves so you have to change the key. Or, you need to change the existing key as a matter of some internal security policy.
How do you do it?
You
- Generate a new keypair
- Add the public key to the EC2 instances' <login user's home dir>/.ssh/authorized_keys
- Remove the old public key from the same authorized_keys file
- Done. The old key is useless now.
- This is not actually revocation
Some things to note about AWS keypairs
- EC2 metadata for the instance(s) will continue to show the original keypair name it was created with, whatever keys you add or remove from authorized_keys. The original public key may not even exist on the instance anymore, if you have gone through the steps above, but the metadata will still show it. This is because AWS has no way of knowing that you changed the authorized_keys file.
- You can upload keys generated by yourself to the AWS console and they will be available for use while launching EC2 instances. Your generated keys have to be RSA keys of 1024, 2048 or 4096 bits.
- AWS keypairs are said to be confined to a single region. This is true only if you consider the default state of affairs. You can get around it.
- For keys that you generate, you can import them to all the regions you want using the AWS console or the CLI tools.
- For keys that AWS generates, you can take the public key from an EC2 instance launched with that key, and import that in a similar manner to all the regions you want. The private key is available for download when you generate the key.