Add GitHub ssh keys to ec2 instance

Question

I would like to share a GitHub project ssh key pair with all new instances that I create so that it's possible to git clone and launch the program from the user data file without having to ssh in the instance.

Quite easy to do on GCP but not quite sure how to do any of that in AWS ec2 instances.

Edit: In GCP I would simply use the "Secret manager" which is shared between instances.

The only option I've found at the moment is to create an AMI that already contains the keys and repo and just add a git pull in the user data file. Doesn't sound like it's a good practice. — Mel
– Mel, Commented Feb 18, 2021 at 23:07
It might be useful to describe in general terms how you'd approach this in GCP, in case there turns out to be a similar mechanism in AWS that you just haven't found yet. — IMSoP
– IMSoP, Commented Feb 18, 2021 at 23:10

IMSoP · Accepted Answer · 2021-02-18 23:24:26Z

6

Since you mention that you'd use Secret Manager in a Google Cloud, it seems reasonable to suggest the AWS Secrets Manager service.

Set your private key as a Secret, and grant access to it with an IAM role attached to the EC2 instance. Then install the AWS CLI package before building the AMI, and you can use it to fetch the secret on first boot with a User Data script.

answered Feb 18, 2021 at 23:24

IMSoP

99.8k18 gold badges135 silver badges183 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mel · Accepted Answer · 2021-02-19 10:46:44Z

3

Because I find the AWS secret manager hard to use and expensive compared to GCP here's the solution I ended up using.

this is my user data file that is passed to the instance on creation.

sudo mkdir ~/.ssh
sudo touch ~/.ssh/id_rsa
sudo echo "-----BEGIN OPENSSH PRIVATE KEY-----
My GitHub private key" >> ~/.ssh/id_rsa
sudo chmod 700 ~/.ssh/
sudo chmod 600 ~/.ssh/id_rsa
git clone https://wwww.github.com/your-repo 
# other commands goes here

Note that it will add this to the root user.

not the cleanest solution but it works well

edit: sudo shouldn't be required because it all runs as root

answered Feb 19, 2021 at 10:46

Mel

7451 gold badge10 silver badges27 bronze badges

1 Comment

IMSoP Over a year ago

The rather serious disadvantage of this is that the private key is visible in plain text to anyone with access to the EC2 console.

Collectives™ on Stack Overflow

Add GitHub ssh keys to ec2 instance

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related