In order to launch an EC2 instance you need a key pair. How do you handle the situation where an engineer with acccess to the private key for that key pair leaves the company? Would it work to add individual ssh access, and deauthorize the initial key pair, immediately after instance launch?
migrated from stackoverflow.com Oct 12 '11 at 3:22
When an employee or contractor leaves the company, you need to disable any privileged access they had to company resources. This includes (but is not limited to) your ssh key concerns:
The alternative method you propose is also good and is one that I use: Disable the initial ssh key and add individual public ssh keys for each developer so they can log in with their normal private ssh key. This can be done for login to a shared account or with each developer getting their own individual user account (my preferred).
After an employee leaves, you'll not only have to clean up running servers, but also the process that adds the ssh keys to new servers. And, when an employee joins, you'll need to do the reverse: Add ssh keys to running servers and update the new server process.
This can be a bit more work to maintain lots of ssh keys across lots of servers, but that's where automation comes in.
See Amazon's documentation on access credential rotation.
Use something like puppet or solid ssh script to run around and replace all the instances of the old key if you don't want to relaunch everything... or just relaunch everything.
|show 1 more comment|