Programming Amazon Web Services

Keypairs

EC2 allows public and private keypairs to be associated with your AWS account as a KeyPair resource that is stored in the EC2 environment. The service will generate a named keypair on demand and will provide you with a once-only downloadable private key. The service keeps an internal copy of the public key corresponding to the private key. When you launch an instance in the service, you can ask the environment to provide the public key from one of your keypairs to the instance as contextual data. The instance can then use this public key as one half of the access credentials required to perform a secure login, so that only someone with access to the corresponding private key can access the instance.

This technique makes it possible to restrict access to EC2 instances to only the user who started a particular instance, despite the fact that many different users may use the same AMI as a starting point for their instance. The keypair access mechanism takes advantage of the EC2 environment’s ability to provide contextual data to an instance (see Instance Data” in Chapter 6), and it relies on the instance being configured to obtain the public key and apply it as a login credential (see Startup Scripts” in Chapter 6).

The publicly available AMIs provided by Amazon are configured to allow secure login based on a keypair that belongs to the user who launches an instance. Because we will be starting with these public AMIs to demonstrate the EC2 API, we must create a keypair ...