Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a quick rhetorical question. I want to create an AMI from my EC2 instance but I want it to be strictly private since it will contain my configs and SSH keys. When creating AMI via the EC2 dashboard I can't see any option to make it private.

So, my two questions are:

  • How can I secure my created AMI so it isn't visible to anyone else
  • Is it secure enough to store my SSH key on it without worrying about
share|improve this question
Never put your credentials on the machine or bundle it as AMI. You might forget that you have them there. Use Roles (part of IAM) instead. – Guy Mar 18 '13 at 19:43
Can this work with SSH keys though @Guy – James Willson Mar 18 '13 at 20:11
The SSH keys are only put on the instance when you launch it. It is not part of the AMI. – Guy Mar 19 '13 at 19:16
When I save them on the drive and create an AMI on it, it should still be there through right? – James Willson Mar 20 '13 at 10:05
Only the public key is put on the instance by EC2, only you have the private part of the key. Anyway once an instance is launched from the AMI, the new public key will replace the one that you had there. – Guy Mar 20 '13 at 16:11
up vote 4 down vote accepted

That's because they're private by default, and sharing is the option you have to add later. The documentation about creating a sharable/paid AMI demonstrates this, but in general the process for creating a non-private AMI is:

  1. Make a private AMI
  2. Share it.
    • Associate a product-code with the AMI through ec2-modify-image-attribute --product-code or a similar API call.
    • Modify the launch permissions through ec2-modify-image-attribute --launch-permissions or similar API call.
  3. Profit!
share|improve this answer
Thank you. Can I trust the security of the private AMI with my SSH key and code do you think? I know it's quite an open eneded question but I would be interested to hear your response. – James Willson Mar 18 '13 at 12:24
@JamesWillson That's an answer you have to ask yourself. In theory, Amazon employees have access to the storage your images are kept on and can read it out. If that's not a risk you want to take, AWS is not the platform for you. – sysadmin1138 Mar 18 '13 at 16:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.