How can I edit or add an SSH keypair for use with EC2 Instance Connect ?

I cannot login with either EC2 Instance Connect or EC2 Instance Connect Endpoint.

There are some Prerequisites for using EIC from your AWS console. They include supported OS, EIC installed in your OS and SG allowing EIC source IPs. (It is possible to install EIC on RHEL/CentOS 7 with SELINUX. Some manual steps are involved, though I suggest a newer OS)

On the portal web page, I get an error "Error establishing SSH connection to your instance. Try again later."

I assume your EC2 is in a public subnet since you are logging in from internet. Can you verify that your EC2 security group allows incoming EC2_INSTANCE_CONNECT IP prefixes for your AWS Region?

See below IP prefixes for different Regions. Do add as source for inbound SSH(TCP 22) to your SG as needed

PS C:\> Get-AWSPublicIpAddressRange -ServiceKey EC2_INSTANCE_CONNECT | Select Region, IpPrefix

Region         IpPrefix
------         --------
cn-north-1     43.196.20.40/29
cn-northwest-1 43.192.155.8/29
us-gov-east-1  18.252.4.0/30
us-gov-west-1  15.200.28.80/30
af-south-1     13.244.121.196/30
ap-east-1      43.198.192.104/29
ap-northeast-1 3.112.23.0/29
ap-northeast-2 13.209.1.56/29
ap-northeast-3 15.168.105.160/29
ap-south-1     13.233.177.0/29
ap-south-2     18.60.252.248/29
ap-southeast-1 3.0.5.32/29
ap-southeast-2 13.239.158.0/29
ap-southeast-3 43.218.193.64/29
ap-southeast-4 16.50.248.80/29
ca-central-1   35.183.92.176/29
eu-central-1   3.120.181.40/29
eu-central-2   16.63.77.8/29
eu-north-1     13.48.4.200/30
eu-south-1     15.161.135.164/30
eu-south-2     18.101.90.48/29
eu-west-1      18.202.216.48/29
eu-west-2      3.8.37.24/29
eu-west-3      35.180.112.80/29
il-central-1   51.16.183.224/29
me-central-1   3.29.147.40/29
me-south-1     16.24.46.56/29
sa-east-1      18.228.70.32/29
us-east-1      18.206.107.24/29
us-east-2      3.16.146.0/29
us-west-1      13.52.6.112/29
us-west-2      18.237.140.160/29

Once verified, try to connect with EIC from AWS EC2 console.

EIC from console does not use your SSH key pair. If you want to use SSH with EIC from your desktop, refer to Connect using your own key and SSH client

Short answer to my problem: RHEL 7 is too old and never supported EC2 Connect in the first place.

Short answer to the question as asked: "How can I edit or add an SSH keypair for use with EC2 Instance Connect ?":

You need to install the ec2-instance-connect package on the instance OS, which retrieves a public key on the fly.

More detail

I created this instance in 2016, running RHEL 7.3. There's a good chance that EC2 Instance Connect didn't exist back than, or that I never used it, and forgot. (2019, per comment below)

So, here's what I found out:

EC2 Instance Connect does not use $HOME/.ssh/authorized_keys with a static public key, as is set up for regular SSH access when you create the instance. It uses AuthorizedKeysCommand in sshd_config, via an Amazon RPM package ec2-instance-connect which modifies sshd_config when installed. Per ec2-instance-connect-prerequisites, ec2-instance-connect is not supported in RHEL 7, only 8 and 9.

I imported ec2-instance-connect-1.1-19.amzn2.noarch.rpm and installed it manually, ignoring the dependency on a later openssh. It failed with an error in /var/log/secure

sshd[21836]: error: Could not stat AuthorizedKeysCommand "/opt/aws/bin/eic_run_authorized_keys %u %f": No such file or directory

Removing the "%u %f" in sshd_config fixed that.

Currently, it runs and connects properly when sshd is started by hand as /usr/sbin/sshd, but not when sshd is started via "systemctl start sshd.service". In that case it errors with "error: AuthorizedKeysCommand /opt/aws/bin/eic_run_authorized_keys returned status 7", apparently failing to retrieve IMDS_TOKEN in eic_curl_authorized_keys.

I will probably abandon this instance altogether and switch to a new Lightsail one, where IPv6 works out of the box (as does web Connect), so I won't pursue this any further.

( I ran sshd on an alternate port to retain access, with an added security rule, while I took sshd on port 22 up and down with systemctl)