How to access EC2 Instance even if PEM file is lost

11
votes

I lost the PEM key to the EC2 Instance. I followed all the following steps:

HOW TO ACCESS EC2 INSTANCE EVEN IF PEM FILE IS LOST

Accessing the EC2 instance even if you loose the pem file is rather easy.

  1. First, create a new instance by creating new access file, call it 'helper' instance with same region and VPC as of the lost pem file instance.

  2. Now stop the lost pem file instance. Remember not to terminate instance but to stop it.

  3. Go to EBS volumes, select the root volume of the lost pem file instance and detach.

  4. Now again select the detached volume and this time you have to attach this volume to helper instance which we created before. Since helper instance already has a root volume by default as /dev/sda1, the newly attached volume will be secondary(eg: /dev/sdf).

  5. Login to your helper instance with its pem file.

  6. Execute below commands:

    # mount /dev/xvdf1 /mnt
# cp /root/.ssh/authorized_keys /mnt/root/.ssh/
# umount /mnt

  7. Detach the secondary volume from helper instance.

  8. Again attach the volume back to our recovery instance. Start the instance. Terminate the helper instance.

Use helper instance pem file to log into recovery instance.

3
amazon-web-servicesamazon-ec2
What do you need help with? Which step did you get stuck at? EC2 instances have pem files which allow ssh, they also have a storage in Volumes which you can track by following the Instance ID and volume ID. These steps are to create a new EC2 with new pem file which you download, detach volume, attach it to new EC2 for which you have new pem and ssh into new EC2. Also if you encrypted your storage you might have tough luck. Saying please help or I followed all the steps does not help anyone identify what you need help with. I hope this helps you at least start at step 1. – devssh
I dont have the PEM file. I am not able to connect to the WP admin page of my website after I installed https plugin. So as to edit the wp-config file I need to access the files via Filezilla or Putty but without the PEM file the connection is not possible. The above steps are what I tried to access without the PEM file. – A K

3 Answers

5
votes

A few weeks ago AWS announced SSM Session Manager. This allows you to access (login) to your EC2 instances without requiring a key pair, password, open ports, etc. Both Windows and Linux are supported.

The latest AMIs do not have the latest version of the SSM agent. You will need to update that first, which you can also do via the SSM Console or via AWS CLI.

AWS Systems Manager Session Manager

Once you connect to your system, you can then correct any problems that you have. For example, you could create a new keypair in the AWS Console and then copy the public key to `~/.ssh/authorized_keys so that you can once again access your system via SSH.

For Windows systems, you can even change the Administrator password if it has been forgotten. This can be a lifesaver.

5
votes

Great to see your answers. Just for the information AWS has shared their official tutorial also for the same hence sharing the same here: https://youtu.be/F8jXE-_hdfg

With this video we can found, AWS support has been getting this same questions from the users and hence made this stuff with detailed structure.

This is with step by step details. Hope this helps.

1
votes

In my case auto-scaling group was enabled so it became easy to attach instance to new Key Pair, Here are the steps that I followed

  1. Created new Key pair under EC2 Dashboard -> Key Pairs (download the .pem file in this step)
  2. Go to Auto Scaling -> Launch Configurations
  3. Select required Launch Configuration and then copy launch configuration
  4. Here while reviewing launch configuration you can create a new key pair or you can select the existing key pair that is created at step 1
  5. Once new launch configuration is created go to the auto-scaling group
  6. Select the auto-scaling group then select new launch configuration from the dropdown
  7. Once this is done if you stop the auto-scaling group instance it will create a new one with the new launch configuration (with new key pair)
  8. List item