I have an AWS EC2 Instance using EBS and I want to stop the use of the current private key, and use a new one. As I understand it, merely deleting the key pair on the AWS Console just deletes the public key and does not prevent access to the instance using the (old) private key via SSH.

I attempted a workaround (detailed here) but I realized this doesn't prevent the use of the old private key.

Is there any way to keep using this instance and prevent the use of the old private key and issue a new one, without having to create a new instance and re-install everything? Can you go into Linux and SSH and manually delete support for specific keys?

I can provide details about the instance configuration as needed.


As far as I know, EC2 key pairs, which appear on AWS console panel, are only used to initialize EC2 instances, granting you initial access to them with the provided key pair. Thus, deleting them on AWS console panel won't make a difference on existing instances.

To prevent the use of the old private key, you need to to edit the .ssh/authorized_keys file on your remote EC2 instance, removing the corresponding entry, which is the public key of your EC2 key pair.

Remember to add your new public key to authrozied_keys file, and test it before removing the old one, or you may be locked out of your EC2 instance.

To issue a new key pair, use ssh-keygen command on your local Linux machine, it's an interactive program when calling without arguments.

And use ssh-copy-id to automatically apply your new key to your instance.

  • So I'm trying to follow your instructions. On my local machine (Mac OSX 10.9) I used ssh-keygen to generate a public (.pub) and private (.pem) key file. Now how do I use ssh-copy-id to apply this key to my instance? When I use ssh-copy-id on my local machine it says command not found. – nhuff717 Sep 6 '14 at 0:22
  • If you cannot use ssh-copy-id, you may also add your public key manully in .ssh/authorized_keys file on your server. Just copy the content of your .pub key file into a seperate line of that file. – pallxk Sep 6 '14 at 0:29
  • 1
    Great, so just to verify the steps (I am not a sys admin): 1. Generate the new key locally using ssh-keygen. 2. Add the contents of the .pub file to a new line of the .ssh/authorized_keys file on the EC2 Instance. 3. Verify that the newly add key works by using ssh -i new-key-file.pem user@ip. Does this sound right? – nhuff717 Sep 6 '14 at 0:34
  • Exactly. And delete your old public key entry, if you do not want it, in .ssh/authorized_keys file after all the operations you mentioned succeed. – pallxk Sep 6 '14 at 0:42

EC2 is just like any other Linux install if you're using Linux, so all you need to do is remove the old key from the authorized_keys file and delete the private key from the .ssh folder and the AWS console to ensure it doesn't come back.

If I remember right, the security keys in the web console generate the first keys that the new instances uses and provides access to the EC2 API (using tools or otherwise), but removing them doesn't remove them from your instances.

  • I will check in again once I look at that file and folder, but first do I need to do anything in /etc/ssh as well? – nhuff717 Sep 3 '14 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.