Chapter 5: Amazon EC2 (Elastic Compute Cloud)
5.4 Connecting to your instance
Quick answer: the short, self-contained version of this lesson is the guide How to SSH into EC2 from Windows, Mac and Linux.
In my classes, this is where most students get stuck the first time – wrong username, wrong key permissions, or port 22 blocked. Don't worry, follow the steps below exactly and it will definitely work.
माझ्या क्लासमध्ये पहिल्या वेळेला सगळ्यात जास्त स्टुडंट्स इथेच अडकतात – चुकीचा यूजरनेम, की च्या चुकीच्या परमिशन्स, किंवा पोर्ट 22 ब्लॉक. काळजी करू नका, खाली दिलेल्या स्टेप्स जशाच्या तशा फॉलो करा, नक्की चालेल.
मेरी क्लास में पहली बार सबसे ज़्यादा स्टूडेंट्स यहीं अटकते हैं – गलत यूज़रनेम, की की गलत परमिशन्स, या पोर्ट 22 ब्लॉक. चिंता मत करो, नीचे दिए स्टेप्स बिल्कुल वैसे ही फ़ॉलो करो, ज़रूर चलेगा.
Default usernames
| AMI | SSH user |
|---|---|
| Amazon Linux 2023 / Amazon Linux 2 | ec2-user |
| Ubuntu | ubuntu |
| CentOS Stream 9 (official) | ec2-user (older CentOS 7/8 AMIs: centos) |
| RHEL | ec2-user |
| Debian | admin |
| SUSE | ec2-user |
From Linux or macOS (OpenSSH)
cd ~/Downloads
chmod 400 mykey.pem # private key must not be readable by others
ssh -i mykey.pem ec2-user@<PUBLIC_IP> # Amazon Linux / CentOS Stream
ssh -i mykey.pem ubuntu@<PUBLIC_IP> # Ubuntu
Type yes when asked "Are you sure you want to continue connecting?" (first time only — it stores the server fingerprint in ~/.ssh/known_hosts).
This fingerprint (a unique mark that identifies the server) is saved on the first connection. The next time, SSH matches this fingerprint, which is why "yes" is asked only once.
हा fingerprint (सर्व्हरची ओळख सांगणारी एक युनिक खूण – ठसा) पहिल्या कनेक्शनला सेव्ह होतो. पुढच्या वेळी SSH हा fingerprint मॅच करतो, म्हणून "yes" फक्त एकदाच विचारलं जातं.
यह fingerprint (सर्वर की पहचान बताने वाला एक यूनिक निशान) पहले कनेक्शन पर सेव हो जाता है. अगली बार SSH इस fingerprint को मैच करता है, इसलिए "yes" सिर्फ़ एक बार पूछा जाता है.
UNPROTECTED PRIVATE KEY FILE!
If you see Permissions 0644 for 'mykey.pem' are too open, SSH refuses to use the key. Fix with chmod 400 mykey.pem. Never share your .pem, never upload it to GitHub, never e-mail it.
From Windows — option 1: built-in OpenSSH (Windows 10/11)
Open PowerShell and fix the key permissions (Windows equivalent of chmod 400):
cd $env:USERPROFILE\Downloads
icacls.exe mykey.pem /reset
icacls.exe mykey.pem /grant:r "$($env:USERNAME):(R)"
icacls.exe mykey.pem /inheritance:r
ssh -i .\mykey.pem ec2-user@<PUBLIC_IP>
From Windows — option 2: PuTTY
- Install PuTTY (includes PuTTYgen).
- If you downloaded a
.pem: open PuTTYgen → Load → choose All files → selectmykey.pem→ Save private key asmykey.ppk. - Open PuTTY → Session → Host Name:
ec2-user@<PUBLIC_IP>(orubuntu@...), Port 22. - Connection → SSH → Auth → Credentials → Private key file for authentication → browse to
mykey.ppk. - Back to Session, type a name under Saved Sessions → Save → Open → Accept the host key.
From Windows — option 3: MobaXterm
- Install MobaXterm (Home edition is free).
- Session → SSH → Remote host:
<PUBLIC_IP>, tick Specify username:ec2-user/ubuntu. - Advanced SSH settings → tick Use private key → select
mykey.pem(MobaXterm accepts .pem directly). - OK. The left panel gives a graphical SFTP browser — drag-and-drop files to upload.
Other connection options
- EC2 Instance Connect (browser-based): select instance → Connect → EC2 Instance Connect tab → Connect. Works out-of-the-box on Amazon Linux and Ubuntu AMIs when port 22 is open to the EC2 Instance Connect IP range for your region (or to
0.0.0.0/0). - Session Manager (AWS Systems Manager): no port 22 needed at all; requires the SSM agent and an IAM role (
AmazonSSMManagedInstanceCore). Recommended in companies.
First commands after logging in
cat /etc/os-release # confirm distribution
sudo yum update -y # AL2023 / CentOS Stream
sudo apt update && sudo apt upgrade -y # Ubuntu
curl -s http://169.254.169.254/latest/meta-data/ -H "X-aws-ec2-metadata-token: $(curl -s -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60')"
sudo timedatectl set-timezone Asia/Kolkata
The first job after logging in: sudo yum update -y and the timezone Asia/Kolkata. The times of Mauli Dairy's orders should show in IST in the logs; otherwise the server stays in UTC and an 8 a.m. order shows up in the logs as 2:30 at night – and then there is confusion.
लॉगिन झाल्यावर पहिलं काम: sudo yum update -y आणि टाइमझोन Asia/Kolkata. Mauli Dairy च्या ऑर्डर्सची वेळ लॉग्समध्ये IST मध्ये दिसली पाहिजे, नाहीतर सर्व्हर UTC मध्ये राहतो आणि सकाळी 8 चा ऑर्डर लॉग्समध्ये रात्री 2:30 चा दिसतो – मग गोंधळ होतो.
लॉगिन के बाद पहला काम: sudo yum update -y और टाइमज़ोन Asia/Kolkata. Mauli Dairy के ऑर्डर्स का समय लॉग्स में IST में दिखना चाहिए, वरना सर्वर UTC में रहता है और सुबह 8 बजे का ऑर्डर लॉग्स में रात 2:30 का दिखता है – फिर कन्फ़्यूज़न होता है.
Instance metadata (IMDSv2)
169.254.169.254 is a special address inside every instance that returns its metadata — instance ID, public IP, AZ, IAM role credentials. New instances require IMDSv2 (token-based), which is why the command above first requests a token. Example: append public-ipv4 or placement/availability-zone to the URL.
Ravindra Bagale's Tip
Keep one folder like ~/aws-keys/ for all your .pem files, run chmod 400 on each file and give keys clear names (mumbai-lab-key.pem). If you lose a private key, AWS cannot give it back. And never, ever push a key to GitHub – bots find secrets in public repositories within minutes.
Ravindra Bagale's Tip – मराठी
तुमच्या सगळ्या .pem files साठी ~/aws-keys/ सारखा एकच folder ठेवा, प्रत्येक file वर chmod 400 चालवा आणि keys ना स्पष्ट नावं द्या (mumbai-lab-key.pem). Private key हरवली तर AWS ती परत देऊ शकत नाही. आणि key कधीच, कधीच GitHub वर push करू नका – bots काही मिनिटांतच public repositories मधली secrets शोधतात.
Ravindra Bagale's Tip – हिंदी
अपनी सारी .pem files के लिए ~/aws-keys/ जैसा एक ही folder रखो, हर file पर chmod 400 चलाओ और keys के नाम साफ़ रखो (mumbai-lab-key.pem). Private key खो गई तो AWS उसे वापस नहीं दे सकता. और key को कभी भी, कभी भी GitHub पर push मत करना – bots कुछ ही मिनटों में public repositories में secrets ढूँढ लेते हैं.
Ravindra Bagale's Tip
Read the error carefully – it tells you the answer. If you get Permission denied (publickey), check three things: the username (ec2-user or ubuntu, depending on the AMI), the key file (the same .pem of the key pair you launched with) and chmod 400. If you get Connection timed out, the problem is the network – check port 22 in the security group and your current IP.
Ravindra Bagale's Tip – मराठी
Error नीट वाचा, तोच उत्तर सांगतो. Permission denied (publickey) आला तर तीन गोष्टी बघा: username (AMI प्रमाणे ec2-user किंवा ubuntu), key file (ज्या key pair ने launch केला तीच .pem) आणि chmod 400. Connection timed out आला तर problem network चा आहे – security group मध्ये port 22 आणि तुमचा आत्ताचा IP बघा.
Ravindra Bagale's Tip – हिंदी
Error ध्यान से पढ़ो, वही जवाब बताता है. Permission denied (publickey) आए तो तीन चीज़ें देखो: username (AMI के हिसाब से ec2-user या ubuntu), key file (जिस key pair से launch किया वही .pem) और chmod 400. Connection timed out आए तो problem network की है – security group में port 22 और अपना अभी का IP देखो.
Lab
Tumchya mauli-web-1 la teen prakare connect kara: OpenSSH (Linux/macOS kiwa Windows PowerShell), PuTTY (.ppk) aani EC2 Instance Connect. Pratyek veli cat /etc/os-release aani sudo yum update -y chalva. Mag muddam ubuntu@ username vaprun connect karun bagha aani kontya error yeto te lihun theva.