I am administering a single (now) ec2 instance which will provide some tools to our users. I am using Ansible to manage it. I have it set to create users using a mix of a Cron-job and Ansible (by creating a list of users and having a playbook ensure they are present).

My main question is this; I am trying to create a way for each user (new and old) to be able to access the instance with their key that they uploaded to EC2 AWS. I have been hitting a dead end in my thoughts on this.. Is there a way to make a call to the AWS api that would return the text of each public key (since they are public I don't see a reason why this shouldn't exist..?) so that I can ensure that a copy of it exists in their respective "~/.ssh/authorized_keys" file?

Other than that I have thought that uploading the keys to an S3 bucket would work for having Ansible read them. The only problem with this is that the users would have to upload their keys to S3.

Any feedback is appreciated-

And if I am attacking this the wrong way please let me know.


My reading of your question is that once a user has imported a key in the AWS console, you'd like a way to import that new key into the actual instances automatically. Unfortunately, the describe-key-pairs API calls return the private key's fingerprint, not the full public key.

If you've got a technically savvy team using this, having them upload to an S3 bucket or a server somewhere may be your best option.

| improve this answer | |
  • Unfortunately that is what I thought. I'm thinking my crew is tech savvy enough to handle the S3 situation even if it's not ideal. Thanks for the input. – catagon87 Jun 11 '14 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.