ec2-instance-connect send-ssh-public-key does not support ed25519 public keys

[aws]

ec2-instance-connect send-ssh-public-key does not support ed25519 public keys

[nexeck]

Is there any eta for this change? The Forum request is nearly 4 years old.

[erict-square]

It seems like ed25519 is supported for EC2 Key Pairs now https://aws.amazon.com/about-aws/whats-new/2021/08/amazon-ec2-customers-ed25519-keys-authentication/. What does it take to get it supported for instance connect as well?

[shaicoleman]

It's finally here:
https://aws.amazon.com/about-aws/whats-new/2022/01/ed25519-keys-authentication-ec2-instance-connect/

This is now working after upgrading to latest AWS CLI (aws-cli/2.4.15)

[nickd-beemit]

Jesus ... 2 years ....

[kdaily]

Hi @bcatubig, thanks for reporting this behavior.

According to the documentation, only RSA keys are supported:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html#ec2-instance-connect-connecting-aws-cli

Would you be able to use and send an RSA public key?

[bcatubig]

Hi @kdaily,

Yes, I am using RSA keys for the time being.

Thanks!

[kdaily]

Hi @bcatubig,

If you feel that you need this feature, please open a thread on the AWS Discussion Forum for EC2:

https://forums.aws.amazon.com/forum.jspa?forumID=30

[julian-alarcon]

There is already a forum/request open https://forums.aws.amazon.com/thread.jspa?threadID=250753

[kdaily]

Hi @julian-alarcon, thanks for posting that. I'm going to transfer this issue to the central AWS SDK tracking repository, and follow up with the EC2 team to see if I can get any further details.

[julian-alarcon]

According to this https://aws.amazon.com/about-aws/whats-new/2021/08/amazon-ec2-customers-ed25519-keys-authentication/ AWS EC2 supports now ed25519 ssh keys.

Can someone make some tests with aws-cli?

[kdaily]

@julian-alarcon,

I was able to successfully import an ed25519 ssh key:

> aws ec2 import-key-pair --key-name test_ed25519_keypair --public-key-material file://~/.ssh/id_ed25519.pub

{
    "KeyFingerprint": "BL.............................",
    "KeyName": "test_ed25519_keypair",
    "KeyPairId": "key-XXXXXXXXXXXXXXXXX"
}

But I was not able to send it to an EC2 instance. Checking in on this.

[kdaily]

V417070100

[kdaily]

I heard back from the EC2 team:

"EC2 Instance Connect does not support ED25519 key pairs. We are working on adding support for it. For more information about ED25519 key pairs, please see our documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html"

I don't have a timeline to supply on when it will be supported.

[github-actions]

This issue is now closed.

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.