AWS AWSEC2 high security documentation change
Summary
Restructured EC2 key pair documentation with updated terminology, added PowerShell examples, reorganized public key retrieval methods, and emphasized IMDSv2 usage
Security assessment
Added explicit IMDSv2 examples with token authentication (security best practice), included chmod 400 guidance for private keys, and restructured content to promote secure metadata retrieval methods. These changes address SSRF risks in IMDSv1 and improve key security practices.
Diff
diff --git a/AWSEC2/latest/UserGuide/describe-keys.md b/AWSEC2/latest/UserGuide/describe-keys.md index 08b79e2d6..db6724eb8 100644 --- a//AWSEC2/latest/UserGuide/describe-keys.md +++ b//AWSEC2/latest/UserGuide/describe-keys.md @@ -11 +11 @@ You can describe the key pairs that you stored in Amazon EC2. You can also retri -###### Topics +###### Tasks @@ -31 +31 @@ Console -###### To view information about your public keys +###### To view information about your key pairs @@ -49 +49 @@ AWS CLI -###### To describe a public key +###### To view information about a key pair @@ -51 +51 @@ AWS CLI -Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-key-pairs.html) command and specify the `--key-names` parameter. +Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-key-pairs.html) command and specify the `--key-names` option. @@ -56 +56 @@ Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/l -Example output +PowerShell @@ -59,12 +59 @@ Example output - { - "KeyPairs": [ - { - "KeyPairId": "key-0123456789example", - "KeyFingerprint": "1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f", - "KeyName": "key-pair-name", - "KeyType": "rsa", - "Tags": [], - "CreateTime": "2022-04-28T11:37:26.000Z" - } - ] - } +###### To view information about a key pair @@ -72 +61 @@ Example output -Alternatively, instead of `--key-names`, you can specify the `--key-pair-ids` parameter to identify the public key. +Use the [Get-EC2KeyPair](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2KeyPair.html) cmdlet and specify the `-KeyName` parameter. @@ -75,23 +64 @@ Alternatively, instead of `--key-names`, you can specify the `--key-pair-ids` pa - aws ec2 describe-key-pairs --key-pair-ids key-0123456789example - -To view the public key material in the output, you must specify the `--include-public-key` parameter. - - - aws ec2 describe-key-pairs --key-names key-pair-name --include-public-key - -Example output – In the output, the `PublicKey` field contains the public key material. - - - { - "KeyPairs": [ - { - "KeyPairId": "key-0123456789example", - "KeyFingerprint": "1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f", - "KeyName": "key-pair-name", - "KeyType": "rsa", - "Tags": [], - **"PublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIj7azlDjVHAsSxgcpCRZ3oWnTm0nAFM64y9jd22ioI/ my-key-pair"** , - "CreateTime": "2022-04-28T11:37:26.000Z" - } - ] - } + Get-EC2KeyPair -KeyName key-pair-name @@ -101,15 +68 @@ Example output – In the output, the `PublicKey` field contains the public key -You can use various methods to get access to the public key material. You can retrieve the public key material from the matching private key on your local computer, from the instance metadata on the instance that was launched with the public key, or by using the `describe-key-pairs` AWS CLI command. For Linux instances, the public key material can also be retrieved from the `authorized_keys` file on the instance. - -Use one of the following methods to retrieve the public key material. - -From the private key - - -###### To retrieve the public key material from the private key - -On your local Linux or macOS computer, you can use the **ssh-keygen** command to retrieve the public key for your key pair. Specify the path where you downloaded your private key (the `.pem` file). - - - ssh-keygen -y -f /path_to_key_pair/my-key-pair.pem - -The command returns the public key, as shown in the following example. +You can get the public key material for your key pairs. The following is an example public key. Note that there are line breaks added for readability. @@ -124,27 +77 @@ The command returns the public key, as shown in the following example. -If the command fails, run the following command to ensure that you've changed the permissions on your private key pair file so that only you can view it. - - - chmod 400 key-pair-name.pem - -From the instance metadata - - -You can use Instance Metadata Service Version 2 or Instance Metadata Service Version 1 to retrieve the public key from the instance metadata. - -###### Note - -If you change the key pair that you use to connect to the instance, Amazon EC2 does not update the instance metadata to show the new public key. The instance metadata continues to show the public key for the key pair that you specified when you launched the instance. - -###### To retrieve the public key material from the instance metadata - -Use one of the following commands from your instance. - -**IMDSv2** - - - [ec2-user ~]$ TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ - && curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key - - -**IMDSv1** - +Private key @@ -152 +78,0 @@ Use one of the following commands from your instance. - [ec2-user ~]$ curl http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key @@ -154,8 +80 @@ Use one of the following commands from your instance. -Example output - - - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClKsfkNkuSevGj3eYhCe53pcjqP3maAhDFcvBS7O6V - hz2ItxCih+PnDSUaw+WNQn/mZphTk/a/gU8jEzoOWbkM4yxyb/wB96xbiFveSFJuOp/d6RJhJOI0iBXr - lsLnBItntckiJ7FbtxJMXLvvwJryDUilBMTjYtwB+QhYXUMOzce5Pjz5/i8SeJtjnV3iAoG/cQk+0FzZ - qaeJAAHco+CY/5WrUBkrHmFJr6HcXkvJdWPkYQS3xqC0+FmUZofz221CBt5IMucxXPkX4rWi+z7wB3Rb - BQoQzd8v7yeb7OzlPnWOyN0qFU0XA246RA8QFYiCNYwI3f05p6KLxEXAMPLE key-pair-name +###### To retrieve the public key material using ssh-keygen (Linux) @@ -163 +82 @@ Example output -For more information about instance metadata, see [Access instance metadata for an EC2 instance](./instancedata-data-retrieval.html). +On your local Linux or macOS computer, use the **ssh-keygen** command. Specify the path where you downloaded your private key (the `.pem` file). @@ -165 +83,0 @@ For more information about instance metadata, see [Access instance metadata for -From the instance @@ -166,0 +85 @@ From the instance + ssh-keygen -y -f /path_to_key_pair/my-key-pair.pem @@ -168 +87 @@ From the instance -If you specify a key pair when launching a Linux instance, when the instance boots for the first time, the content of the public key is placed on the instance in an entry within `~/.ssh/authorized_keys`. +If this **ssh-keygen** command fails, run the following **chmod** command to ensure that the private key file has the required permissions. @@ -170 +88,0 @@ If you specify a key pair when launching a Linux instance, when the instance boo -###### To retrieve the public key material from an instance @@ -172 +90 @@ If you specify a key pair when launching a Linux instance, when the instance boo - 1. [Connect to your instance](./connect-to-linux-instance.html). + chmod 400 key-pair-name.pem @@ -174 +92 @@ If you specify a key pair when launching a Linux instance, when the instance boo - 2. In the terminal window, open the `authorized_keys` file using your favorite text editor (such as **vim** or **nano**). +###### To retrieve the public key material using PuTTYgen (Windows) @@ -176 +94 @@ If you specify a key pair when launching a Linux instance, when the instance boo - [ec2-user ~]$ nano ~/.ssh/authorized_keys +On your local Windows computer, start PuTTYgen. Choose **Load**. Select the `.ppk` or `.pem` private key file. PuTTYgen displays the public key under **Public key for pasting into OpenSSH authorized_keys file**. You can also view the public key by choosing **Save public key** , specifying a name for the file, saving the file, and then opening the file. @@ -178 +96 @@ If you specify a key pair when launching a Linux instance, when the instance boo -The `authorized_keys` file opens, displaying the public key followed by the name of the key pair. The following is an example entry for the key pair named ``key-pair-name``. +AWS CLI @@ -180,5 +97,0 @@ The `authorized_keys` file opens, displaying the public key followed by the name - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQClKsfkNkuSevGj3eYhCe53pcjqP3maAhDFcvBS7O6V - hz2ItxCih+PnDSUaw+WNQn/mZphTk/a/gU8jEzoOWbkM4yxyb/wB96xbiFveSFJuOp/d6RJhJOI0iBXr - lsLnBItntckiJ7FbtxJMXLvvwJryDUilBMTjYtwB+QhYXUMOzce5Pjz5/i8SeJtjnV3iAoG/cQk+0FzZ - qaeJAAHco+CY/5WrUBkrHmFJr6HcXkvJdWPkYQS3xqC0+FmUZofz221CBt5IMucxXPkX4rWi+z7wB3Rb - BQoQzd8v7yeb7OzlPnWOyN0qFU0XA246RA8QFYiCNYwI3f05p6KLxEXAMPLE key-pair-name @@ -185,0 +99 @@ The `authorized_keys` file opens, displaying the public key followed by the name +###### To retrieve the public key material @@ -186,0 +101 @@ The `authorized_keys` file opens, displaying the public key followed by the name +Use the following [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-key-pairs.html) command and specify the `--include-public-key` option. @@ -189 +104,4 @@ The `authorized_keys` file opens, displaying the public key followed by the name -From describe-key-pairs + aws ec2 describe-key-pairs \ + --key-names key-pair-name \ + --include-public-key \ + --query "KeyPairs[].PublicKey" @@ -190,0 +109 @@ From describe-key-pairs +PowerShell @@ -192 +110,0 @@ From describe-key-pairs -###### To retrieve the public key material using the `describe-key-pairs`AWS CLI command @@ -194 +112 @@ From describe-key-pairs -Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-key-pairs.html) command and specify the `--key-names` parameter to identify the public key. To include the public key material in the output, specify the `--include-public-key` parameter. +###### To retrieve the public key material @@ -195,0 +114 @@ Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/l +Use the following [Get-EC2KeyPair](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2KeyPair.html) cmdlet. @@ -197 +115,0 @@ Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/l - aws ec2 describe-key-pairs --key-names key-pair-name --include-public-key @@ -199 +117 @@ Use the [describe-key-pairs](https://awscli.amazonaws.com/v2/documentation/api/l -Example output – In the output, the `PublicKey` field contains the public key material. + (Get-EC2KeyPair -KeyName key-pair-name -IncludePublicKey $true).PublicKey @@ -200,0 +119 @@ Example output – In the output, the `PublicKey` field contains the public key +IMDSv2 @@ -202,13 +120,0 @@ Example output – In the output, the `PublicKey` field contains the public key - { - "KeyPairs": [ - { - "KeyPairId": "key-0123456789example", - "KeyFingerprint": "1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f", - "KeyName": "key-pair-name", - "KeyType": "rsa", - "Tags": [], - **"PublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIj7azlDjVHAsSxgcpCRZ3oWnTm0nAFM64y9jd22ioI/ my-key-pair"** , - "CreateTime": "2022-04-28T11:37:26.000Z" - } - ] - } @@ -216 +122 @@ Example output – In the output, the `PublicKey` field contains the public key -Alternatively, instead of `--key-names`, you can specify the `--key-pair-ids` parameter to identify the public key. +###### Linux @@ -217,0 +124 @@ Alternatively, instead of `--key-names`, you can specify the `--key-pair-ids` pa +Run the following commands from your Linux instance. @@ -219 +125,0 @@ Alternatively, instead of `--key-names`, you can specify the `--key-pair-ids` pa - aws ec2 describe-key-pairs --key-pair-ids key-0123456789example --include-public-key @@ -221 +127,2 @@ Alternatively, instead of `--key-names`, you can specify the `--key-pair-ids` pa -From the private key + TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ + && curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key