The OP is asking about the instance's SSH host public key, not the SSH client public key (which is what is tied to an EC2 "key pair" and what you specify when you launch the EC2 instance). Each EC2 instance generates a new host key the first time it boots. Then, when you connect from a client, SSH complains that the host key has changed, and you have to reset the entry in your client's ~/.ssh/known_hosts.
Unfortunately there is no secure and programmatic way to get a new EC2 instance's public host key. What everyone does is blindly connect to the EC2 instance the first time, ignoring warnings about unknown host keys, trusting that there is no man-in-the-middle, and cache the host key in ~/.aws/known_hosts for future use. This must be done every time an EC2 instance is reprovisioned.
One simple secure solution would be to add a script to the EC2 instance that runs on first boot and "publishes" the generated SSH host public key to a well-known and trusted location (e.g., An S3 object that is readable by anyone but can only be written by the EC2 instance's IAM role). Then, you can simply wait for the EC2 instance to boot for the first time, then download the SSH public host key from S3 and add it to your client's ~/.ssh/known_hosts file. After that, SSH will connect successfully with no host key warnings. Of course, every time you redeploy the EC2 instance, the host key will change and you will have to refresh the entry in ~/.ssh/known_hosts. But at least it is secure.
Another secure solution that would have the advantage of a stable host key that survives instance redeployments would be to generate a host key pair before the EC2 instance is launched, and pass it to the EC2 instance for use on first boot (either directly through user-data or indirectly with AWS secrets manager, S3, etc.). Then, you would add a script that runs on first boot that sets/replaces the SSH host key in the EC2 instance.
Then you can directly add the known and trusted host key to your client's ~/.ssh/known_hosts, and the key will remain stable across EC2 instance redeployments.
Managing all this, and protecting the secrecy of the sensitive host private key, is inconvenient and brings its own set of problems. Most people just accept that they have to take a leap of faith and refresh the host key over an insecure channel each time the EC2 instance is redeployed.
