Search for a command to run...
Powershell script to SSH to AWS EC2 from Windows
I work as a Tech Arch Senior Manager at Accenture and am a mother to two wonderful kids who test my patience and inspire me to be curious. I love cooking, reading, and painting.
No comments yet. Be the first to comment.
A Tale of Protocol Quirks, JSON Wrestling, and the Joy of Finding the Bug
In 2018, OpenAI pledged its "primary fiduciary duty is to humanity." Seven years later, the company launches erotic AI companions while families testify in courtrooms about children who never came home. We're conducting the largest unregulated behavi...
Did you know that 68% of organizations now identify data silos as their top operational concern? A 7% increase from 2023, according to a 2024 DATAVERSITY® Trends in Data Management Survey. In today's hyper-personalized business landscape, enterprises...
The Changing Search Paradigm This week, OpenAI introduced shopping capabilities within ChatGPT's search feature, coinciding with Mastercard unveiling Agent Pay, a new payment approach that enables AI agents to securely complete purchases. These devel...
The Reality of AI Hallucinations: Recent Examples Last week, the AI coding assistant tool Cursor encountered a crisis when its front-line AI support bot named “Sam” confidently provided a user with a completely fabricated policy. The user raised a su...
Have you attempted to connect to an EC2 instance from your machine? If so, you will know that the secure connection can only be established after running the chmod400 command on the security key pair file. The downside, there is no chmod command utility in Windows like we do in macOS, Linux, and other Unix-like operating systems.
So, this post will detail an alternative - a PowerShell script that can be run to SSH to an EC2 instance from Windows OS and does an equivalent job to the chmod400 command.
The command when run on the security key pair file removes all access to the file and gives only the current user read permission. So, when connecting to an EC2 instance, we are making sure no one has "write" access to the security key pair file. This is a mandatory requirement to connect to the EC2 instance safely.
If running from MacOs or Linux, the command will be like this:
$ chmod 400 securityfile.txt
The updated file permissions will look something like this:
| User | Group | Other | |
| Read | Yes | No | No |
| Write | No | No | No |
| Execute | No | No | No |
The chmod command utility is not supported on windows. There are other ways to apply for the same file permissions. One way is to right-click on the file properties, and security tab and then click on the Advanced button. In this screen, you will have to disable inheritance and then remove access to all users except for the current user. All these steps sound very tedious and if you consider doing it multiple times on different security key pair files to connect to other EC2 instances, it sounds unproductive!
So, here comes the magic script that does all that. But before you run the script make sure OpenSSH.Client and OpenSSH. Servers are installed on your machine. These two are required to run the SSH command and can be found from this link. Also, Powershell should have Microsoft.Powershell.Security Module installed. This script makes use of some of the cmdlets from this module.
#NOTE: Update the below parameters with your EC2 details before running this script.
#Parameters for Running the script
[string] $keyFile = "C:\AWS\ec2KeyPair.pem"
[string] $publicip = "ec2-user@XX.xXX.xXX.xxX" #update the public ip address here
#view the security key file permissions
Write-Host "Current ACL permissions to the security file:"
Get-Acl $keyFile | fl
#add a current user with read control to the security file
$acl = Get-Acl $keyFile
$uName = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($uName,"Read","Allow")
$acl.SetAccessRule($accessRule)
$acl | Set-Acl $keyFile
#Delete inherited permissions
$acl.SetAccessRuleProtection($true,$false)
$acl | Set-Acl $keyFile
Write-Host "ACL Permissions after disabling inheritance and adding full control access to current user:"
Get-Acl $keyFile | fl
# ssh to the ec2-instance
ssh -i $keyFile $publicip
Copy the above script and update the parameters section with the location of your security key pair file and EC2 instance IP address. Once the file is saved, you just run the script. See, it is that simple and reduces running through multiple steps.
Enjoy my blog? For more such awesome blog articles - follow, subscribe and let's connect.