Philip M. Gollucci
Did you really just put a private key in an s3 bucket without a 1yr lecture on why thats bad? I realize its for example only
Certified Security - Specialty
Sign Up Free or Log In to participate!
Did you really just put a private key in an s3 bucket without a 1yr lecture on why thats bad? I realize its for example only
Exactly — there are no such things as fixed "best practices." Everything is based on risk context. And even for routine use, putting keys in a well-secured S3 bucket carries no more risk than any other portable media.
No need for the private key to exist anywhere other than the device that requires the access. Generate the key pair there and copy up the public key to the EC2 instance (or cut and paste).
+1 @Michael McGuinness the better option would have been to create the key pair on his laptop and upload the pub key to S3. Or just use ssh-copy-id.
As an alternative, you can use session manager to ssh to linux boxes with no effort. This way you don’t really need the keys.