Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are the keypairs created and added when launching an EC2 instance added to ~/.ssh/authorized_keys for the ec2-user ? or is there another mechanism used? If so, would the key have a name like 'master'? I'm trying to audit the public keys on various instances and don't want to delete a master key.

Also does the .pem key file downloaded from the AWS console also contain an X.509 certificate?

share|improve this question

Yes. That is correct. It is added to /home/ec2-user/.ssh/authorized_keys. You only get a RSA private key if I remember correctly. This is done through the cloud-init scripts that are installed as part of the AMI you choose. This also helps if you are relaunching an AMI you are locked out of as it will add the new key to the authorized_keys of ec2-user allowing you to recover the server even if completely locked out, assuming you create a new key pair.

share|improve this answer

If you called the key "master" when you created it, during the launch process, then the key in authorized_keys will be called "master". If you didn't, the key has come from somewhere else.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.