Re:The surprising persistence of RSA keys in SSH
by cjcampbell on Saturday May 30, 2020 @02:36AM
(#23359022)
This may not work for your requirements, but one approach worth considering is to create your instances without a key pair and then leverage Systems Manager to push your ed25519 keys to the system.
This can be done with RunCommand, a manual Session Manager connection, or by storing your public keys in parameter store and pulling them in via a startup scrip in Instance Metadata.
To take advantage of SessionManager or RunCommand, you do need to have the SSM agent installed along with an IAM role. This isn’t a fit for every set of requirements.
The latter approach can be accomplished with a minimal IAM role and the AWS CLI. In the event your subnet doesn’t have NAT, you will need an SSM endpoint in your VPC.
This can be done with RunCommand, a manual Session Manager connection, or by storing your public keys in parameter store and pulling them in via a startup scrip in Instance Metadata.
To take advantage of SessionManager or RunCommand, you do need to have the SSM agent installed along with an IAM role. This isn’t a fit for every set of requirements.
The latter approach can be accomplished with a minimal IAM role and the AWS CLI. In the event your subnet doesn’t have NAT, you will need an SSM endpoint in your VPC.