Ssh – EC2: how to download the private key file for a user

To change the passphrase on your default key:

$ ssh-keygen -p

If you need to specify a key, pass the -f option:

$ ssh-keygen -p -f ~/.ssh/id_dsa

then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

More details from man ssh-keygen:

[...]
SYNOPSIS
    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
[...]
     -f filename
             Specifies the filename of the key file.
[...]
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
[...]

The AWS private key is associated with your X.509 certficate; it isn't the same as an SSH private key. See this summary of AWS security credentials.

The X.509 certificate is associated with your AWS account rather than with individual EC2 instances; if you start a new instance using your custom AMI, it will be associated with the X.509 certificate and private key defined in your account.

If you also have an authorized_keys file containing your personal SSH public key bundled into the AMI, you should be able to log in with your own SSH key - this is independent of the X.509 certificate, which is used to authenticate AWS API calls.