EC2 Key Pairs vs AWS Credentials: Practical Fixes for SSH and Security Group Setup

This guide explains the two setup issues that most often block first-time EC2 deployments: mixing up AWS API credentials with EC2 SSH key pairs, and forgetting to allow SSH in security groups. If you are onboarding to Amazon EC2 or troubleshooting SSH-based automation, you will learn what each credential is for, how to configure access correctly, and how to verify it with practical commands.

Originally published on 2010-03-09; fully revised and updated.

Untangling EC2 key pairs and AWS API credentials

In the original context, this confusion frequently affected users of Cloud Tools and Cloud Foundry. The core issue is still common: the key used to sign AWS API calls is not the same key used to SSH into an EC2 instance.

In most modern environments, teams prefer short-lived credentials through IAM roles for API access. But for direct SSH, EC2 key pairs are still a standard pattern unless your organization uses an alternative such as Session Manager.

EC2 access workflow at a glance

flowchart TD
    A[Create EC2 key pair] --> B[Download private key file]
    B --> C[Set secure file permissions]
    C --> D[Allow SSH in security group]
    D --> E[Launch instance with key pair name]
    E --> F[Connect with ssh using private key]
    F --> G{Connected}
    G -- no --> H[Check key name security group username and network path]
    G -- yes --> I[Continue with provisioning]

Create an EC2 key pair and protect the private key

You can create key pairs from the AWS console or CLI. The critical part is that the private key must be stored securely, and access to that file must be restricted.

aws ec2 create-key-pair --key-name demo-key --query 'KeyMaterial' --output text > demo-key.pem
chmod 400 demo-key.pem
aws ec2 describe-key-pairs --key-names demo-keyCode language: JavaScript (javascript)

• Open the EC2 console and go to Key Pairs.
• Choose Create key pair.
• Enter a key pair name, create it, and download the private key file immediately.

Historical AWS console screenshots from the original article: Creating a key pair and Saving a key pair.

Allow SSH in the correct security group

If port 22 is blocked, SSH-based tooling will fail even when the key pair is correct. Apply ingress rules to the security group attached to your instance, and prefer a narrow source CIDR instead of broad internet access.

aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp \
  --port 22 \
  --cidr 203.0.113.10/32

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

Launch and connect to an instance

At launch time, specify the key pair name. At connection time, provide the matching private key file to SSH.

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type t3.micro \
  --key-name demo-key \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0

ssh -i demo-key.pem ec2-user@EC2_PUBLIC_DNSCode language: CSS (css)

If login fails, verify all four elements together: instance key pair name, private key file, security group rules, and OS username (for example, many images use ec2-user or ubuntu).

Choose an access pattern

Common pitfalls and best practices

• Do not confuse AWS API credentials with EC2 SSH key pairs; they solve different problems.
• Download private key material once, then store it securely and set restrictive file permissions.
• Avoid opening SSH to 0.0.0.0/0 unless there is a temporary, controlled need.
• Confirm the instance is attached to the security group you edited.
• Use reproducible commands or Infrastructure as Code instead of one-off manual fixes.
• Where possible, prefer short-lived API credentials and centrally managed access patterns.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.