Rotate EC2 Key Pair

This will make use of AWS Systems Manager to perform batch update of the new key pair

Perquisites: EC2 instances can be managed by AWS Systems Manager

1. Go to AWS Console → EC2 → Network & Security → Key Pairs
2. Create a new key pair with the default settings.
3. For the name of the key pair, append with the version suffix
4. Download the private key file (IMPORTANT: please store this file carefully as it will be the only time you can download the file)
5. Set the permission of the private key to

sudo chmod 600 NEWKEY.pem

1. Run this command to generate the public key of the key pair

ssh-keygen -f NEWKEY.pem -y

1. Save the public key output to a temporary location
2. Go to AWS Console → AWS Systems Manager → Node Management → Run Command
3. Select AWS-RunShellScript under the Command document.
4. Insert the following under Command Parameters (replace public-key with the one generated earlier)

#!/bin/bash

/bin/echo -e "public-key" > /home/ubuntu/.ssh/authorized_keys

1. Specify the Target instances to update the new public key
2. Click on Run
3. Change the private key to the newly created key for any application that needs to uses it (this means updating secrets in CI server etc.)

Some other alternatives to achieve the same result:

• Ansible – https://github.com/sebinxavi/aws-key-rotation