AWS AWSEC2 documentation change

Service: AWSEC2 · 2025-04-28 · Documentation low

File: AWSEC2/latest/UserGuide/retrieve-ekpub.md

Summary

Added PowerShell examples and clarified TPM key retrieval documentation

Security assessment

Expands documentation for security-related TPM key retrieval features but does not address a specific vulnerability

Diff

diff --git a/AWSEC2/latest/UserGuide/retrieve-ekpub.md b/AWSEC2/latest/UserGuide/retrieve-ekpub.md
index 67cc8a19b..2fdd2bb38 100644
--- a//AWSEC2/latest/UserGuide/retrieve-ekpub.md
+++ b//AWSEC2/latest/UserGuide/retrieve-ekpub.md
@@ -5 +5,5 @@
-# Retrieve the public endorsement key for an Amazon EC2 instance
+# Retrieve the public endorsement key for an EC2 instance
+
+You can securely retrieve the public endorsement key for an instance at any time.
+
+AWS CLI
@@ -7 +10,0 @@
-You can securely retrieve the public endorsement key for an instance at any time using the AWS CLI.
@@ -15 +18 @@ Use the [get-instance-tpm-ek-pub](https://awscli.amazonaws.com/v2/documentation/
-The following example command gets the `rsa-2048` public endorsement key in `tpmt` format for the specified instance.
+The following example gets the `rsa-2048` public endorsement key in `tpmt` format for the specified instance.
@@ -18 +21,2 @@ The following example command gets the `rsa-2048` public endorsement key in `tpm
-    aws ec2 get-instance-tpm-ek-pub \--instance-id i-01234567890abcdef \
+    aws ec2 get-instance-tpm-ek-pub \
+        --instance-id i-1234567890abcdef0 \
@@ -39 +43 @@ The following is the example output.
-The following example command gets the `rsa-2048` public endorsement key in `der` format for the specified instance.
+The following example gets the `rsa-2048` public endorsement key in `der` format for the specified instance.
@@ -43 +47 @@ The following example command gets the `rsa-2048` public endorsement key in `der
-    --instance-id i-01234567890abcdef \
+        --instance-id i-1234567890abcdef0 \
@@ -51 +55 @@ The following is the example output.
-        "InstanceId": "i-01234567890abcdef",
+        "InstanceId": "i-1234567890abcdef0",
@@ -61,0 +66,27 @@ The following is the example output.
+PowerShell
+    
+
+###### To retrieve the public endorsement key for an instance
+
+Use the [Get-EC2InstanceTpmEkPub](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2InstanceTpmEkPub.html) cmdlet.
+
+###### Example 1
+
+The following example gets the `rsa-2048` public endorsement key in `tpmt` format for the specified instance.
+    
+    
+    Get-EC2InstanceTpmEkPub `
+        -InstanceId i-1234567890abcdef0 `
+        -KeyFormat tpmt `
+        -KeyType rsa-2048
+
+###### Example 2
+
+The following example gets the `rsa-2048` public endorsement key in `der` format for the specified instance.
+    
+    
+    Get-EC2InstanceTpmEkPub `
+        -InstanceId i-1234567890abcdef0 `
+        -KeyFormat der `
+        -KeyType rsa-2048
+