When I created my EC2 instance, I was given a .pem private key file. I did it as the root user for my account. Then I created an IAM user and associated that user with a full EC2 access. When I logged in as that user, I was able to see the instance I created as root but when I went to see the connection instructions, they were the same as for the root, specifying the same private key file as the root. My instance type is Ubuntu so the default user on the instance is ubuntu.

My question is, how can I enforce that when a user connects to an instance, he is associated with his own host (instance) user? So if the AWS root logs into the instance as ubuntu, I would like the AWS user awsuser1 to be logged into the instance as ubuntu1.


When you create an EC2 instance, the instance will only ever be associated with a single key pair .pem file. That's as far as AWS will do anything for you in this regard.

Any user (IAM or root) will always see the same connection instructions. However, only the person with the actual .pem file will be able to connect as the main Linux user (ec2-user for AWS Linux, ubuntu for Ubuntu Linux, etc.)

To setup your EC2 instance such that it supports multiple users with multiple key .pem files, you need to follow these instructions from the AWS docs: Managing User Accounts on Your Linux Instance. Note that this has nothing to do with IAM users or anything related to IAM. It's purely Linux administration.

Essentially the process is:

  1. Sign-in to the Linux instance.
  2. Sudo to get root privileges.
  3. adduser to add the user.
  4. Create a .ssh/authorized_keys with the public key that matches your desired private key .pem file.
| improve this answer | |
  • If you need something less manual, you can use AD/LDAP, Hashicorp Vault, or a variety of other options I'm not very familiar with. – Xiong Chiamiov Jun 25 '16 at 0:05
  • Something I particularly don't like is that the pem is downloaded only once upon instance creation and that it needs to be sent over network (email) to other users who connect to the instance – amphibient Jun 25 '16 at 0:31
  • 1
    @amphibient the user may create his own key pair at home and newer send the private kay anywhere, but send you the public key only, which is not secret. Then you'll add that public key to .ssh/authorized_keys for newly created user and you're here! – Putnik Jun 25 '16 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.