How to manage EC2 key pairs for multiple users?

Question

I'm working in a team with 8 people. I need to create an EC2 intance. Just before I create the instance, EC2 lets me create a key-pair and then download it.

The problem is: That way I need to share the same private key for all 8 team members.

Now, what happens if tomorrow one of the teammates leave? I will need to recreate the machine with a new key pair.

How can I manage the keys correctly so every team member will have his/her unique key that is associate with his/her IAM user, so once he/she leaves the company, I will be able to invalidate his/her key?

Answer 1

Try to avoid giving the PEMs for the instances to everyone, keep these with the Administrators in a tool such as a password vault.

Remember that to rotate these PEMs you would need to manually replace the authorized_keys on any Linux instance, and for Windows instances where you use this PEM to get the Windows password you would need to replace and launch with the new PEM.

AWS has a couple of solutions that help make secure access to your Linux instances easier:

• If you do not require to actually SSH to the host, but just need terminal access you can make use of Session Manager. Using this tool you can access a terminal within the AWS console or connect via the CLI. Interactions with the terminal can be scoped to allow only specific commands with functionality for auditing built in.
• If you would like to connect to a terminal, you can use EC2 instance connect. Using this option you can generate a temporary key and then provide this via the CLI to allow temporary access using this PEM. Once this command is run (and is successful) you will be able to connect to the instance temporarily using the SSH terminal with your temporary PEM.

Answer 2

I suggest looking into using EC2 Instance Connect which uses temporary SSH keys and allows you to grant access using IAM policies.

Otherwise, I suggest using a tool like Ansible to manage the SSH keys on your fleet of instances so you can easily add or remove keys.