EC2 Instance private key lost with no way to connect

Troubleshooting Context: AWSSupport-ResetAccess Failure

The AWSSupport-ResetAccess runbook fails with the Desired values: ['windows'] error because the target instance is not managed by AWS Systems Manager (SSM). Without a functional SSM Agent, the runbook cannot query the instance's OS platform, resulting in an empty API return value that fails the automation's prerequisite checks.

Method 1: Snapshot and Re-deployment (AMI Method)

This approach relies on baking the current state of the inaccessible instance into an Amazon Machine Image (AMI) and launching a clone with a new key pair.

• Stop the unreachable EC2 instance.
• Select the instance in the EC2 Console, choose Actions > Image and templates > Create image.
• Once the AMI is available, navigate to the AMIs section, select the newly created image, and choose Launch instance from AMI.
• During the launch configuration, explicitly select a new, accessible SSH key pair that you possess.
• Reassign any existing Elastic IPs from the original instance to the newly launched instance.
• Verify SSH connectivity to the new instance. Once confirmed, the original instance can be terminated.

Method 2: Rescue Instance / Root Volume Modification (Supported Alternative)

If the original instance must be strictly preserved (e.g., to retain the exact instance ID, MAC address, or private IP), AWS supports modifying the root volume via a temporary rescue instance.

• Stop the unreachable EC2 instance.
• Detach its root EBS volume. Note the exact device name prior to detachment (typically /dev/xvda or /dev/sda1).
• Launch a temporary "rescue" instance in the exact same Availability Zone as the original instance.
• Attach the detached root volume to the rescue instance as a secondary volume (e.g., /dev/xvdf).
• SSH into the rescue instance and mount the attached volume:

sudo mkdir /mnt/target
   sudo mount /dev/xvdf1 /mnt/target

(Note: Adjust the partition identifier if necessary).

• Inject the new SSH public key into the target OS user's authorized keys file:

echo "your_new_public_key" | sudo tee -a /mnt/target/home/ec2-user/.ssh/authorized_keys

• Ensure strict ownership and permissions are maintained on the mounted volume:

   sudo chmod 600 /mnt/target/home/ec2-user/.ssh/authorized_keys
   sudo chmod 700 /mnt/target/home/ec2-user/.ssh

• Unmount the volume (sudo umount /mnt/target), detach it from the rescue instance, and reattach it to the original instance using the exact device name noted in Step 2.
• Start the original instance and connect using the new private key.

Official AWS References

• AWS Knowledge Center (re:Post): Connect to an EC2 instance when I lost my SSH key pair - https://repost.aws/knowledge-center/user-data-replace-key-pair-ec2
• AWS Knowledge Center (re:Post): How do I resolve SSH connection issues to my Amazon EC2 Linux instance? - https://repost.aws/knowledge-center/ec2-linux-ssh-troubleshooting
• AWS Documentation: Add or replace a public key on your Linux instance - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replacing-key-pair.html