Chapter 5: Amazon EC2 (Elastic Compute Cloud)

5.4 Connecting to your instance

By Ravindra Bagale · Last updated: 25 September 2026

In my sessions, this is where most students get stuck for the first time — wrong username, wrong key permissions, or port 22 blocked. Kalji karu naka, follow the steps exactly and it will work.

Default usernames

From Linux or macOS (OpenSSH)

cd ~/Downloads
chmod 400 mykey.pem                                  # private key must not be readable by others
ssh -i mykey.pem ec2-user@<PUBLIC_IP>                # Amazon Linux / CentOS Stream
ssh -i mykey.pem ubuntu@<PUBLIC_IP>                  # Ubuntu

Type yes when asked "Are you sure you want to continue connecting?" (first time only — it stores the server fingerprint in ~/.ssh/known_hosts).

From Windows — option 1: built-in OpenSSH (Windows 10/11)

Open PowerShell and fix the key permissions (Windows equivalent of chmod 400):

cd $env:USERPROFILE\Downloads
icacls.exe mykey.pem /reset
icacls.exe mykey.pem /grant:r "$($env:USERNAME):(R)"
icacls.exe mykey.pem /inheritance:r
ssh -i .\mykey.pem ec2-user@<PUBLIC_IP>

From Windows — option 2: PuTTY

1. Install PuTTY (includes PuTTYgen).
2. If you downloaded a .pem: open PuTTYgen → Load → choose All files → select mykey.pem → Save private key as mykey.ppk.
3. Open PuTTY → Session → Host Name: ec2-user@<PUBLIC_IP> (or ubuntu@...), Port 22.
4. Connection → SSH → Auth → Credentials → Private key file for authentication → browse to mykey.ppk.
5. Back to Session, type a name under Saved Sessions → Save → Open → Accept the host key.

From Windows — option 3: MobaXterm

1. Install MobaXterm (Home edition is free).
2. Session → SSH → Remote host: <PUBLIC_IP>, tick Specify username: ec2-user / ubuntu.
3. Advanced SSH settings → tick Use private key → select mykey.pem (MobaXterm accepts .pem directly).
4. OK. The left panel gives a graphical SFTP browser — drag-and-drop files to upload.

Other connection options

• EC2 Instance Connect (browser-based): select instance → Connect → EC2 Instance Connect tab → Connect. Works out-of-the-box on Amazon Linux and Ubuntu AMIs when port 22 is open to the EC2 Instance Connect IP range for your region (or to 0.0.0.0/0).
• Session Manager (AWS Systems Manager): no port 22 needed at all; requires the SSM agent and an IAM role (AmazonSSMManagedInstanceCore). Recommended in companies.

First commands after logging in

cat /etc/os-release                 # confirm distribution
sudo yum update -y                 # AL2023 / CentOS Stream
sudo apt update && sudo apt upgrade -y   # Ubuntu
curl -s http://169.254.169.254/latest/meta-data/ -H "X-aws-ec2-metadata-token: $(curl -s -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60')"
sudo timedatectl set-timezone Asia/Kolkata