DEV Community

Cover image for 🔐 AWS 122: Passwordless SSH Automation with EC2 User Data
Hritik Raj
Hritik Raj

Posted on

🔐 AWS 122: Passwordless SSH Automation with EC2 User Data

#aws #ssh #automation #100daysofcloud

AWS

🔑 The Landing Host Pattern: Secure Passwordless SSH Access

Hey Cloud Builders 👋

Welcome to Day 22 of the #100DaysOfCloud Challenge!
Today, we’re solving a real-world DevOps security problem for the Nautilus team enabling secure, passwordless SSH access from a landing host (aws-client) to a newly launched EC2 instance (devops-ec2).

Architecture

By combining SSH key-based authentication with EC2 User Data, we can fully automate access from the very first boot 🚀

🎯 Objective

  • Launch a t2.micro EC2 instance
  • Generate an RSA key pair on the landing host
  • Automatically configure root SSH access using User Data
  • Enable passwordless authentication

💡 Why SSH Keys & User Data Matter

Using passwords for SSH is risky and outdated. SSH keys provide stronger security and are essential for automation.

🔹 Key Concepts

  • Landing (Bastion) Host

    Acts as a controlled entry point to your infrastructure for better auditing and security.

  • EC2 User Data

    A script that runs once at first boot, perfect for:

    • Installing packages
    • Creating users
    • Configuring SSH keys

  • Automation Benefit

    No manual key copying. No human error. Scales effortlessly.

🛠️ Step-by-Step: Secure SSH Setup

We’ll move logically from the client → AWS → EC2.

🔹 Phase A: Generate SSH Key Pair (Landing Host)

On the aws-client, navigate to the SSH directory:

cd /root/.ssh
ssh-keygen -t rsa
Enter fullscreen mode Exit fullscreen mode

Key Generation

Display and copy the public key:

cat /root/.ssh/id_rsa.pub
Enter fullscreen mode Exit fullscreen mode

Public Key

🔹 Phase B: Import Key Pair into AWS

Log in to the AWS Console and do the following:

  • Open the AWS Management Console
  • Navigate to EC2 → Network & Security → Key Pairs
  • Click Import key pair

Key Pair

  • Paste the public key generated on the landing host
  • Click Import

Import Key

🔹 Phase C: Launch EC2 with User Data Automation

EC2 Configuration

  • Name: devops-ec2
  • Instance Type: t2.micro
  • AMI: Ubuntu or Amazon Linux

Launch EC2

User Data Script

Paste this under Advanced Details → User Data:

#!/bin/bash
mkdir -p /root/.ssh
chmod 700 /root/.ssh
echo "ssh-rsa YOUR_PUBLIC_KEY_HERE" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
sed -i 's/^#PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

User Data

🔹 Phase D: Final SSH Hardening (Optional)

Some AMIs restrict root login by default.

  • Log in as ubuntu or ec2-user
  • Switch to root: 
sudo su -
Enter fullscreen mode Exit fullscreen mode
  • Ensure SSH config contains: 
PermitRootLogin yes
Enter fullscreen mode Exit fullscreen mode
  • Restart SSH: 
systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

✅ Verify Passwordless Access

From the aws-client:

ssh root@<EC2_PUBLIC_IP>
Enter fullscreen mode Exit fullscreen mode

🎉 If you land directly in the root shell mission accomplished!

SSH Success

📝 Key Takeaways

  • 🚀 User Data = Automation Superpower
  • 🔐 SSH permissions must be exact (700 & 600)
  • ⚠️ Root login is okay for labs avoid in production

🚫 Common Mistakes

  • Adding keys to the wrong user directory
  • Breaking SSH with bad sed syntax
  • Uploading private keys instead of public ones

🌟 Final Thoughts

You didn’t just launch an EC2
you automated secure access like a real Cloud Engineer 💪

This pattern is foundational for:

  • CI/CD pipelines
  • Auto Scaling
  • Zero-touch infrastructure

🔗 Let’s Connect

Top comments (0)