How to remove access for an AWS keypair

amazon ec2amazon-web-services

If someone with a .pem keypair for a number of EC2 instances leaves the company, what is best practice for removing access for that key? Presumably simply deleting the key from the AWS console does not then deny them access to all instances so is there a smart way to audit and remove their access? If I don't have a copy of the keyfile, how can one be sure they didn't add the public key to other instances?

Assume Ubuntu 12.04 EC2 instances

Best Answer

After installation, Amazon doesn't do anything to your instances anymore so I don't think they have functionality to provide for this scenario. You could hack up a script to loop over all instances and check if his key is there (it's not pretty, but it'll work :) ):

for INSTANCE in $(ec2-describe-instances | grep INSTANC | grep running | awk '{print $4;}')
do
  ssh -lec2-user -oStrictHostKeyChecking=no $INSTANCE 'cat ~/.ssh/authorized_keys | grep mtak'
  if [ $? -eq 0 ];
    then
    echo $INSTANCE
  fi
done

You could also add a sed on-liner to remove the key from the authorized_keys file.

Related Topic