How do I replace a lost key pair for my Amazon EC2 Windows instance?

Short description

To replace a lost key pair, use the AWSSupport-ResetAccess runbook. Or, create an Amazon Machine Image (AMI), and then launch a new instance from the AMI.

Resolution

Use the AWSSupport-ResetAccess Automation runbook

Prerequisite: Make sure that you adhere to the AWSSupport-ResetAccess runbook requirements.

Run the AWSSupport-ResetAccess runbook to replace a lost key pair or local administrator password.

Create an AMI, and then launch a new instance

Note: The following resolution steps require you to stop and start your instance.

Configure your instance for a stop and start

Note: When you stop and start an instance, the instance's public IP address changes. It's a best practice to use an Elastic IP address to route external traffic to your instance instead of a public IP address. If you use Amazon Route 53, then you might need to update the Route 53 DNS records when the public IP address changes. A stop and start is different from an instance reboot. For more information, see How EC2 instance stop and start works.

Before you stop and start your instance, take the following actions:

• If your instance uses an instance store, then save the volume data on the instance store to persistent storage. For example, you can save the data to Amazon Elastic Block Store (Amazon EBS) or Amazon Simple Storage Service (Amazon S3) buckets.
  Important: Amazon EC2 deletes instance store data when you stop the instance.
• Create a snapshot of your Amazon EBS volume. If you experience issues, then you can use the snapshot to restore your instance.
• Temporarily remove the instance from its Amazon EC2 Auto Scaling group so that you don't accidentally terminate the instance when you stop it.
  Note: EC2 Auto Scaling might terminate stopped instances in an Auto Scaling group based on your scale-in protection settings. Instances that you launch with Amazon EMR, AWS CloudFormation, or AWS Elastic Beanstalk might be in an Auto Scaling group.
• Set the instance shutdown behavior to Stop to make sure that the instance doesn't terminate when you stop it.

Create the AMI

Complete the following steps:

1. Create a new key pair, and then save the private key file.
   Note: To give the new key pair the same name as the lost key pair, first delete the lost key pair.
2. Open the Amazon EC2 console.
3. In the navigation pane, choose Instances, and then choose your instance.
4. Choose the Details tab. Note the values for the instance type, virtual private cloud (VPC) ID, subnet ID, security groups, and AWS Identity and Access Management (IAM) role.
5. Stop your instance.
6. Choose your instance.
7. Choose Actions, and then select Image and templates.
8. Choose Create Image, and then configure the image settings.
9. Choose Create Image, and then choose Close.

Launch a new instance from the AMI

Complete the following steps:

1. Open the Amazon EC2 console.
2. In the navigation pane, choose AMIs.
3. Wait until the Status for the new AMI is Available, and then choose the AMI.
4. Choose Launch instance from AMI.
5. Use the launch instance wizard to launch the instance. For Instance type, VPC ID, Subnet ID, Security groups, and IAM role, use the same values as the original instance. For Key pair (login), choose the new key pair.
6. (Optional) If the original instance has an associated Elastic IP address, then associate the Elastic IP address with the new instance.
7. (Optional) If you didn't snapshot your EBS volumes when you created your AMI, then detach the volume from the original instance. Then, attach the volume to the new instance.
   Note: You don't need to unmount the volume when you detach it because the original instance is already in the Stopped state.
8. To reset the administrator password, use one of the following methods:
   Use EC2Config for Windows Server 2012 R2 or earlier.
   -or-
   Use EC2Launch for Windows Server 2016 or later.
   -or-
   Use EC2Launch v2 for supported Windows AMIs that include EC2Launch v2.
9. (Optional) Terminate the stopped instance with the lost key pair. After you launch the new instance, you can also deregister the AMI.
   Note: It's a best practice to deregister AMIs that you no longer use. Stored AMIs might result in additional costs.

Related information

Amazon EC2 key pairs and Amazon EC2 instances