Are the keypairs created and added when launching an EC2 instance added to ~/.ssh/authorized_keys for the ec2-user ? or is there another mechanism used? If so, would the key have a name like 'master'? I'm trying to audit the public keys on various instances and don't want to delete a master key.
Also does the .pem key file downloaded from the AWS console also contain an X.509 certificate?
Yes. That is correct. It is added to /home/ec2-user/.ssh/authorized_keys. You only get a RSA private key if I remember correctly. This is done through the cloud-init scripts that are installed as part of the AMI you choose. This also helps if you are relaunching an AMI you are locked out of as it will add the new key to the authorized_keys of ec2-user allowing you to recover the server even if completely locked out, assuming you create a new key pair.
If you called the key "master" when you created it, during the launch process, then the key in authorized_keys will be called "master". If you didn't, the key has come from somewhere else.
