DEV Community

Mike Anderson
Mike Anderson

Posted on

Copy Files Between a Mac and AWS EC2 with SCP

#tutorial #devops #aws #security

If you already connect from your Mac to a Linux Amazon EC2 instance with an SSH key pair, scp is the simplest tool for a one-time file transfer. It uses the same SSH connection, identity, and network path.

One detail matters: your private key stays on the Mac. The instance stores the corresponding public key for the Linux user, normally in ~/.ssh/authorized_keys. Do not upload the private key to EC2.

Prerequisites

You need:

  • the EC2 public DNS name or public IP address;
  • the correct Linux username;
  • the matching private key on your Mac;
  • TCP/22 access from your current public IP in the instance security group; and
  • permission to write to the destination directory.

Common usernames are ec2-user for Amazon Linux and ubuntu for Ubuntu. The correct username is determined by the Amazon Machine Image (AMI), so confirm it rather than guessing.

The examples below use:

Private key:  ~/.ssh/prod-ec2.pem
Instance:     ec2-203-0-113-10.compute-1.amazonaws.com
User:         ec2-user
Local file:   ~/Downloads/security-report.html
Remote path:  /home/ec2-user/
Enter fullscreen mode Exit fullscreen mode

Replace every example value with your own.

1. Protect the private key

In Terminal on the Mac, restrict the key so other local users cannot read it:

chmod 400 ~/.ssh/prod-ec2.pem
Enter fullscreen mode Exit fullscreen mode

2. Confirm SSH access first 

ssh -i ~/.ssh/prod-ec2.pem \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com
Enter fullscreen mode Exit fullscreen mode

On the first connection, verify the host-key fingerprint before accepting it. Exit after the login succeeds:

exit
Enter fullscreen mode Exit fullscreen mode

If SSH does not work, scp will not work either. Fix the username, key, routing, security-group rule, or host-key issue first.

3. Copy a file from the Mac to EC2

Run this command on the Mac:

scp -i ~/.ssh/prod-ec2.pem \
  ~/Downloads/security-report.html \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com:/home/ec2-user/
Enter fullscreen mode Exit fullscreen mode

The colon after the hostname is significant. It separates the remote host from the remote path.

Confirm the uploaded file:

ssh -i ~/.ssh/prod-ec2.pem \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com \
  'ls -lh /home/ec2-user/security-report.html'
Enter fullscreen mode Exit fullscreen mode

To place a file in a root-owned directory, upload it to your home directory first, then move it deliberately:

ssh -i ~/.ssh/prod-ec2.pem \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com \
  'sudo mv /home/ec2-user/security-report.html /var/www/html/'
Enter fullscreen mode Exit fullscreen mode

4. Copy a file from EC2 to the Mac

Reverse the source and destination. Run this command on the Mac, not inside the EC2 SSH session:

scp -i ~/.ssh/prod-ec2.pem \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com:/home/ec2-user/security-report.html \
  ~/Downloads/
Enter fullscreen mode Exit fullscreen mode

Confirm the downloaded file:

ls -lh ~/Downloads/security-report.html
Enter fullscreen mode Exit fullscreen mode

Copy a directory

Add -r for a recursive directory copy.

Mac to EC2:

scp -r -i ~/.ssh/prod-ec2.pem \
  ~/Documents/report-package \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com:/home/ec2-user/
Enter fullscreen mode Exit fullscreen mode

EC2 to Mac:

scp -r -i ~/.ssh/prod-ec2.pem \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com:/home/ec2-user/report-package \
  ~/Downloads/
Enter fullscreen mode Exit fullscreen mode

Non-standard SSH port

For a custom SSH port, use uppercase -P with scp:

scp -P 2222 -i ~/.ssh/prod-ec2.pem \
  ~/Downloads/security-report.html \
  ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com:/home/ec2-user/
Enter fullscreen mode Exit fullscreen mode

The corresponding ssh option is lowercase -p 2222.

Common failures

Permission denied (publickey)

Usually the username is wrong, the private key does not match the instance user’s authorized public key, or the key file is too broadly accessible. Test the exact identity with ssh -i before retrying scp.

Operation timed out or Connection timed out

Check that the instance is running and reachable, and that the effective security-group and network rules allow the SSH port from your current public IP. Avoid exposing SSH to 0.0.0.0/0; restrict it to a controlled source range.

Permission denied for the destination path

Authentication succeeded, but the remote Linux user cannot write there. Upload to the user’s home directory, then use a separately reviewed sudo mv command if elevated placement is required.

No such file or directory

Check which side owns the missing path. Paths before user@host: are local; paths after it are remote. Quote a path if it contains spaces.

Security and operational notes

scp is appropriate for simple, one-time copies. For repeated synchronization or large datasets, AWS recommends considering rsync over SSH because it can transfer only changed data.

Direct scp also requires an SSH network path to the instance. For production systems, prefer private connectivity, a controlled bastion, EC2 Instance Connect Endpoint, or AWS Systems Manager where the architecture supports it. Do not broaden port 22 exposure merely to make a transfer convenient.

Top comments (0)