1

The situation, I've inherited a windows infrastructure in AWS. The ami's were created with someone else's keypair who has now left the business. I have a requirement to remove those keys.

The way I have found so far is to create a new windows ami, detach the disks from the instance with the keypair to be removed and attach the disks to the new instance with the new keypair as /dev/sda1.

In my testing I discovered that once the disks are reattached you can't recover the windows password as the keypair fail. That's fine as the infrastructure to be changed is has AD logins. I'll be testing today on a test instance that will have AD.

Are there any concerns to my approach, or is there something better?

Just to clarify its not the iam it's the actual public private key pair they created to launch the (16 of them) actual instance. in the Instance dashboard each server shows as having Mr. A.N. Others key name in the key name column. The business wants it changed

3
  • Wait a minute... the keypair isn't an attribute of an AMI, is it? The keypair should be selected when an instance is launched, so I'm having trouble sorting out this question. If you launch a new instance from the Windows AMI, doesn't it give you a prompt at the end to choose which keypair you want to use? Jan 21, 2016 at 21:08
  • yes that is right, I can use a different keypair to launch. The existing instances that were created using a historic keypair
    – Ourjamie
    Jan 22, 2016 at 11:40
  • You have to relaunch them to change the keypair that shows up in the console. The keypair for an instance, as far as the EC2 infrastructure is concerned, doesn't change after launch. Does that help? Jan 22, 2016 at 12:31

2 Answers 2

0

I haven't tried it as I don't use Windows instances, but this AWS documentation suggests deleting the user in IAM revokes their access. I'd be surprised if you had to do the work you described just because one user in your organisation happened to create a server then leave the company.

This is very easy to try. I'm incorrect please do comment so I can remove any incorrect advice.

2
  • 1
    I'm reasonably sure that OP is referring to SSH keys, rather than the AWS IAM access key/secret, but also no, anyone in possession of credentials for access to an EC2 instance via the code on the machine itself would be unaffected by the state of their IAM account. Jan 21, 2016 at 10:50
  • It seems like it should be easy to revoke access to a server based on private keys. I'm sure it is easy, it's just finding out exactly how to do it.
    – Tim
    Jan 21, 2016 at 18:19
0

I managed to get it done by Stopping the instance detaching the drive created a new instance with new keypair stopped it detached drive attached original drive started instance

in the web console previous employees keypair gone, replaced with new keypair name.

downside is that the new keypair will not allow me to get the windows admin password.

moral of this story is, manage the keypairs properly

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .