Add ability to add EC2 key-pair

[porn]

Please add the ability to create EC2 key pairs via CDK.

Use Case

I would like not to have to interact with AWS Console at all.
Want my keys git-versioned and manageable from CDK.

Proposed Solution

key = aws_ec2.KeyPair(
    key_name="autoscaled",
    public_key="ssh-rsa AAAABBBBBCCC...",
)

Other

Couldn't find a way how to do that in documentation. I believe this is not doable with CDK right now.

Seems the only way is to manually add key-pair via web Console and use key_name string parameter for the EC2 machine:
https://stackoverflow.com/questions/57572065/how-can-i-access-an-ec2-instance-created-by-cdk

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

[Lightning303]

Hey,
you can do this right now using a custom resource.

https://docs.aws.amazon.com/cdk/api/latest/docs/aws-cloudformation-readme.html
https://docs.aws.amazon.com/cdk/api/latest/docs/custom-resources-readme.html

[udondan]

CloudFormation doesn't support keypair generation/import.

Here's something that might be interesting: https://binx.io/blog/2017/10/25/deploying-private-key-pairs-with-aws-cloudformation/

[netroy]

created a ticket for the Cloudformation team
aws-cloudformation/cloudformation-coverage-roadmap#335

[udondan]

I don't think this is going to be implemented. Because there is no way to download a key after it has been created. So since you cannot download it, and you certainly do not want to have the key in the CFN outputs either, there is no secure way to create a key with CFN.

Though I created a custom resource based on the link above. The key is stored encrypted in SSM parameter store.

https://github.com/udondan/cdk-secrets

There is an example: https://github.com/udondan/cdk-secrets/blob/master/example/lib/key-pair.ts

[richardhboyd]

there is no secure way to create a key with CFN.

Lambda Custom Resource that puts the key pair into secrets manager and exports the name of the secret. This is done in several AWS Quickstarts. This is definitely doable.

[udondan]

The sentence you quoted was in reply to a feature request on the CFN repo. While you of course can do it with a custom CFN resource, this cannot be implemented in core CFN functionality. The resource type is missing for a reason.

Right after the quoted sentence, I wrote about custom resources, even with a link to a ready-to-use cdk construct. 😉

[logemann]

There is an external NPM which tries to solve it via SecretsManager but somehow this doesnt convince me either ;-)

https://www.npmjs.com/package/cdk-ec2-key-pair

[udondan]

That's my package. Where else would you like it to be stored?

[logemann]

perhaps i got this package wrong... where is the actual key value? In description attribute? Or is it just a reference to a manually placed private key in SecretsManager?

[udondan]

The private key is stored as a secret in the SecretsManager. If you provide a KMS CMK it also will be encrypted. So you got to control who can access it even if you got roles/users who are allowed to do everything.

You could also go and reset the value of the secret, after you have retrieved the key.

[russd2357]

In your package, you grant read access to 'someRole'. If I am using your package to generate key pairs for an EC2 instance, which role would you advise?

[russd2357]

I re-read the thread and I think I got it. You're suggesting to create a role that is allowed to access the key. Only users with that role can access the key. Yes?

[udondan]

That's just an example on how to grant access. If you want to grant access or to which role is up to you and the use case. If you just want to create the key-pair and download the private key, you can just download it with the same role/user you create it with.

PS: Such things are better asked in a new issue in the packages repo. :)

[inickles-grapl]

CloudFormation doesn't support keypair generation/import.

Seems like CDK + CloudFormation should support the "Import key pair" functionality of the console UI*, which not a great wording - it's not a pair, it imports only a pubkey. The scenario is I create a new keypair locally on my machine, I create a new EC2 instance with CDK, I now want to authenticate to this instance with that keypair I made. The private key is nowhere in AWS. To do this now I need to use the console, breaking automation.

Propose solution looks the same as OP, since those are the only inputs to the existing functionality in the console UI.

• https://us-east-2.console.aws.amazon.com/ec2/v2/home?region=us-east-2#ImportKeyPair:

[sjortiz]

I also need this, a newly created instance that has my public key added so I can ssh, no need to return me my key that I already have in ~/.ssh/id_rsa.pub

[UsernameAlvarez]

Also I need this feature when I create a newly instance so I don't need to interact with the AWS Console. It would be great!!!

[honey-malviya]

we need this feature too. please add it asap.

[darshan-yadav]

This is something i was also looking for. Please provide this feature.

[danil-smirnov]

Would be great to have

[ilikepi63]

Would be really nice to have

[udondan]

FYI My construct cdk-ec2-key-pair does support importing public keys since version 3.2.0 (only for CDK v2)

new KeyPair(this, 'Test-Key-Pair', {
  name: 'imported-key-pair',
  publicKey: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuMmbK...'
});

https://constructs.dev/packages/cdk-ec2-key-pair/v/3.2.0?lang=typescript#importing-public-key

[0ni0nrings]

@udondan thanks for sharing your construct.

Is there a Python example available? I am getting error when doing 👇

bastion_key = KeyPair(self, 'bastion-key',
            name = 'bastion-key',
            description = 'keypair for bastion host',
        ),

[github-actions]

This issue has received a significant amount of attention so we are automatically upgrading its priority. A member of the community will see the re-prioritization and provide an update on the issue.

[aaroncowie]

Given that AWS::EC2::KeyPair is now available in cloudformation can this be revisited?

It seems as though the tags "effort/large" and "needs-cfn" may no longer apply.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.