Key Pairs & Security Groups

Key pairs let you log in securely over SSH, and security groups act as a virtual firewall around your instance.

Two things control access to an EC2 instance: how you log in, and what network traffic is allowed.

Key pairs

A key pair is a public/private key used for SSH. AWS stores the public key and injects it into the instance; you keep the private .pem file and use it to connect. AWS never stores your private key, so if you lose it you cannot recover it.

Security groups

A security group is a stateful virtual firewall attached to an instance. You define inbound and outbound rules by port, protocol and source.

  • Stateful — if you allow inbound traffic, the reply is automatically allowed out.
  • Only allow rules exist — there is no explicit deny.
  • You can reference another security group as the source, not just IP ranges.

Example

Example · bash
# Create a key pair and save the private key locally
aws ec2 create-key-pair --key-name my-key \
  --query "KeyMaterial" --output text > my-key.pem
chmod 400 my-key.pem

# Create a security group and allow HTTP from anywhere + SSH from your IP
aws ec2 create-security-group --group-name web-sg \
  --description "Web server" --vpc-id vpc-0a1b2c3d4e5f67890
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 22 --cidr 203.0.113.25/32

When to use it

  • A developer creates an EC2 key pair and stores the private key locally to SSH into a Linux instance without a password.
  • A security group is configured to allow HTTPS traffic from anywhere (0.0.0.0/0 on port 443) but SSH only from the office IP block.
  • A database EC2 instance's security group allows port 5432 only from the security group of the application servers, not from the internet.

More examples

Create Key Pair and Save Locally

Creates an EC2 key pair, saves the private key to disk, and sets secure permissions so SSH accepts it.

Example · bash
aws ec2 create-key-pair \
  --key-name my-ec2-key \
  --query 'KeyMaterial' \
  --output text > ~/.ssh/my-ec2-key.pem

chmod 400 ~/.ssh/my-ec2-key.pem

Create a Web Server Security Group

Creates a security group and opens ports 80 and 443 to the public internet, typical for a web server.

Example · bash
SG=$(aws ec2 create-security-group \
  --group-name web-sg \
  --description "Allow HTTP and HTTPS" \
  --query GroupId --output text)

aws ec2 authorize-security-group-ingress \
  --group-id $SG \
  --protocol tcp --port 80 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
  --group-id $SG \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

Restrict SSH to Office IP Only

Adds SSH access from a specific IP range and removes any existing open-internet SSH rule for better security.

Example · bash
aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp \
  --port 22 \
  --cidr 203.0.113.0/24

# Revoke open SSH if it was accidentally set
aws ec2 revoke-security-group-ingress \
  --group-id sg-0abc123 \
  --protocol tcp \
  --port 22 \
  --cidr 0.0.0.0/0

Related

aws ec2 introaws sg vs nacl

Discussion

  • Be the first to comment on this lesson.