I want to host a EC2 instance on a different user's account while keeping all shell access to myself. I can just create the instance and keep the private key, but according to https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#replacing-lost-key-pair, the owner of the AWS account where the EC2 instance is stored can recover the key by detaching and reattaching the root volume to a new instance.

My idea is to encrypt the volume (by creating a snapshot of the volume, encrypt it using my own personal KMS key - here giving temporary access to the new user, and attaching it to the EC2 instance) and then revoke access to the KMS key from the new user. I've tried the detach and reattach method outlined by the aforementioned link after revoking KMS key access, and an error occurs (Client.InternalError: Client error on launch) when starting the new instance (which has the encrypted volume attached) - which I want.

My question is, is this a valid way of accomplishing what I want - Hosting an EC2 instance on a different user account while preventing shell access completely?

  • I'm not sure I understand your idea or how it could work. I wonder if operating system level encryption is the way to go. Search for "(your operating system) create encrypted partition (or disk)". – Tim Jul 13 '18 at 9:29
  • Your comment about recovering the SSH key is incorrect. They can only replace your SSH key. The important part - the private key - is not normally copied to the server that you connect to. You keep the private key private on your system. – John Hanley Jul 14 '18 at 6:24

No that is not valid solution for limiting access. The correct solution is to host customer resources on a new account that you own. Obviously running anything on an account owned by someone else will never be secure, since they can create an IAM role to do anything. Sure you can revoke a cross account KMS key, but then they might just terminate your instance.

I would suggest creating a new account (yuck paperwork), but this is what is necessary. If the client is to be a payer, you might send them an invoice matching the monthly AWS bill, but that is in your domain, as it should be.

If you really need to host an instance on another person's account, encrypting the volume is about as good security that you can get, but remember that the client can literally destroy the instance at will.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.