I lost the pem file and deleted the key-pair under which an instance in currently running. I want to still use that server though. I created a new key pair but I don't know how to assign it to that instance.

7 Answers 7


You can go to your instance and say " launch instance like this". This time it will create clone of your EC2 instance. You can specify new key for this instance. Make sure you select the same security group.

This way, you will not loose your data and you will gain access to your ec2 instance with new key.

Note: If your old instance had EIP then you need to re-assign that EIP to new instance.

If your instance does not have EIP then you need to make sure you update your other instances with new private IP address or URL so that connectivity will not be broken.

If there are any EBS volumes attached to your previous instance then you need to attach to new instance.

Termination of old EC2 can be done as last step!!!.


Unless you have another way to log into the instance, you're not going to be able to access it. Amazon does not have your private key and cannot log in to your instance.

If you still need your data, disconnect the EBS-volume and attach it to a new EC2-instance.

  • There's no way at all to assign a new key pair then? May 25, 2011 at 15:55
  • 2
    Nope, AWS can't acces the instance after creation. May 25, 2011 at 17:23
  • Since you have access to the drive, you can attach it to another instance, update the key store, and then switch it back to its original instance to gain access to it. The process is detailed here: stackoverflow.com/a/11776183/97964
    – jocull
    Oct 21, 2016 at 14:30

There is no option to detach/attach a new security key (pem) from/to your instance till now in AWS. Once you lost your pem key you can't login again. So the only way to regain the access is creating an AMI of the instance and launch it with a new key.


I just went through this, and surprisingly, it was fairly "simple". I had the more difficult-to-recover S3 instance. EBS instances are easier.

For S3-backed instance:

  1. You must have support through AWS. Well worth it, great support and all responses are answered withing 2 hours - I just bought the lowest cost tier of support.

  2. Request AWS Back-Up. Per AWS: "AWS Support has a data recovery tool that will attempt to copy the instance store volume to an EBS backed volume. If the process is successful, you will be able to attach the created EBS volume to an instance and copy the needed data off to another volume. You must leave the instance running through out the process. The recovery tool will basically create an image of the current instance store data. There are some caveats you must be made aware of, though. The data recovery process can take days to complete. AWS support provides no guarantees regarding the state of the data returned."

  3. Create a snapshot of the volume[s]

  4. From the snapshot, create an Image

  5. From the Image, launch an Instance

  6. SSH into new instance and verify proper server files [e.g. /etc/postfix]

  7. Set Elastic IP on new server

  8. In Route 53, set A records to new server



I found the a solution to the problem here on aws site. The short version is to attach your EBS disk to another instance and replace the public key.

If you lose the private key for an EBS-backed instance, you can regain access to your instance. You must stop the instance, detach its root volume and attach it to another instance as a data volume, modify the authorized_keys file, move the volume back to the original instance, and restart the instance. For more information about launching, connecting to, and stopping instances, see Instance Lifecycle.

This procedure isn't supported for instance store-backed instances. To determine the root device type of your instance, open the Amazon EC2 console, choose Instances, select the instance, and check the value of Root device type in the details pane. The value is either ebs or instance store. If the root device is an instance store volume, you must have the private key in order to connect to the instance.


  • Thanks for your answer. On Server Fault we like if people give the actual steps in their post, rather than just a link, because links often expire, content is deleted, etc. You can copy and paste them and do a little formatting.
    – Tim
    Aug 14, 2017 at 2:52

You can try the amazon systems manager to log into your system. Then you need to reverse engineer the authorized_keys file inside the ~/.ssh/authorized_keys
Hope this works.


You can ONLY get access to instance using private key that was created specific for the instance. Thats because in launch wizard you agree that you will access only through that key (see the screenshot below). Be sure to save the private key and it should have 400 permissions.

Screenshot when creating a instance

But there is a way around. You can get access to instance, by cloning the image instance. see here: https://forums.aws.amazon.com/message.jspa?messageID=549256

It says that

An instance can only be associated with a key pair only at launch time (either to an existing key pair or by creating a new key pair). that means if you lose the key pair then you won't be able to generate another one for that already running instance or associate it with an already existing key pair. To urgently address your issue, you may try to do the following:-

  1. From your WAS console stop the instance in question
  2. Create a snapshot of the instance
  3. Create a duplicate instance from the resulting snapshot and create a new Key Pair.
  • 1
    I'm not sure why you're bumping a years-old question to answer it with the same information as the existing accepted answer.
    – ceejayoz
    Aug 19, 2015 at 16:01
  • @ceejayoz It would not hurt to have some useful information, even it is old.
    – pbu
    Aug 19, 2015 at 16:03
  • 2
    This answer is not technically correct. The reason you can't access the instance if you lose the key isn't "because in launch wizard you agree that you will access only through that key", it's because there is no technical way to access the instance without the key. This doesn't have anything to do with honoring an agreement. The note must be checked as an acknowledgement of the warning, not an agreement to the conditions.
    – austinian
    Aug 19, 2015 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .