Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I lost the pem file and deleted the key-pair under which an instance in currently running. I want to still use that server though. I created a new key pair but I don't know how to assign it to that instance.

share|improve this question

You can go to your instance and say " launch instance like this". This time it will create clone of your EC2 instance. You can specify new key for this instance. Make sure you select the same security group.

This way, you will not loose your data and you will gain access to your ec2 instance with new key.

Note: If your old instance had EIP then you need to re-assign that EIP to new instance.

If your instance does not have EIP then you need to make sure you update your other instances with new private IP address or URL so that connectivity will not be broken.

If there are any EBS volumes attached to your previous instance then you need to attach to new instance.

Termination of old EC2 can be done as last step!!!.

share|improve this answer

Unless you have another way to log into the instance, you're not going to be able to access it. Amazon does not have your private key and cannot log in to your instance.

If you still need your data, disconnect the EBS-volume and attach it to a new EC2-instance.

share|improve this answer
There's no way at all to assign a new key pair then? – Jorge Guzman May 25 '11 at 15:55
Nope, AWS can't acces the instance after creation. – Bart De Vos May 25 '11 at 17:23

There is no option to detach/attach a new security key (pem) from/to your instance till now in AWS. Once you lost your pem key you can't login again. So the only way to regain the access is creating an AMI of the instance and launch it with a new key.

share|improve this answer

I just went through this, and surprisingly, it was fairly "simple". I had the more difficult-to-recover S3 instance. EBS instances are easier.

For S3-backed instance:

  1. You must have support through AWS. Well worth it, great support and all responses are answered withing 2 hours - I just bought the lowest cost tier of support.

  2. Request AWS Back-Up. Per AWS: "AWS Support has a data recovery tool that will attempt to copy the instance store volume to an EBS backed volume. If the process is successful, you will be able to attach the created EBS volume to an instance and copy the needed data off to another volume. You must leave the instance running through out the process. The recovery tool will basically create an image of the current instance store data. There are some caveats you must be made aware of, though. The data recovery process can take days to complete. AWS support provides no guarantees regarding the state of the data returned."

  3. Create a snapshot of the volume[s]

  4. From the snapshot, create an Image

  5. From the Image, launch an Instance

  6. SSH into new instance and verify proper server files [e.g. /etc/postfix]

  7. Set Elastic IP on new server

  8. In Route 53, set A records to new server


share|improve this answer

You can ONLY get access to instance using private key that was created specific for the instance. Thats because in launch wizard you agree that you will access only through that key (see the screenshot below). Be sure to save the private key and it should have 400 permissions.

Screenshot when creating a instance

But there is a way around. You can get access to instance, by cloning the image instance. see here:

It says that

An instance can only be associated with a key pair only at launch time (either to an existing key pair or by creating a new key pair). that means if you lose the key pair then you won't be able to generate another one for that already running instance or associate it with an already existing key pair. To urgently address your issue, you may try to do the following:-

  1. From your WAS console stop the instance in question
  2. Create a snapshot of the instance
  3. Create a duplicate instance from the resulting snapshot and create a new Key Pair.
share|improve this answer
I'm not sure why you're bumping a years-old question to answer it with the same information as the existing accepted answer. – ceejayoz Aug 19 '15 at 16:01
@ceejayoz It would not hurt to have some useful information, even it is old. – pbu Aug 19 '15 at 16:03
This answer is not technically correct. The reason you can't access the instance if you lose the key isn't "because in launch wizard you agree that you will access only through that key", it's because there is no technical way to access the instance without the key. This doesn't have anything to do with honoring an agreement. The note must be checked as an acknowledgement of the warning, not an agreement to the conditions. – austinian Aug 19 '15 at 16:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.