{"id":20655046,"url":"https://github.com/devops-ia/aws-ssh-key-lambda-rotation","last_synced_at":"2026-05-21T05:04:26.331Z","repository":{"id":42571694,"uuid":"476237049","full_name":"devops-ia/aws-ssh-key-lambda-rotation","owner":"devops-ia","description":"SSH key rotation of AWS EC2 instances with AWS Lambda and AWS System Manager","archived":false,"fork":false,"pushed_at":"2026-05-02T06:32:54.000Z","size":594,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-02T08:29:15.734Z","etag":null,"topics":["aws","aws-lambda","aws-s3","ssh","ssm","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/devops-ia.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-03-31T09:26:17.000Z","updated_at":"2026-05-02T06:32:56.000Z","dependencies_parsed_at":"2024-09-05T23:24:13.104Z","dependency_job_id":"d4a745e3-2984-4b1c-a20a-6c6141e0f8a6","html_url":"https://github.com/devops-ia/aws-ssh-key-lambda-rotation","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/devops-ia/aws-ssh-key-lambda-rotation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/devops-ia%2Faws-ssh-key-lambda-rotation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/devops-ia%2Faws-ssh-key-lambda-rotation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/devops-ia%2Faws-ssh-key-lambda-rotation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/devops-ia%2Faws-ssh-key-lambda-rotation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/devops-ia","download_url":"https://codeload.github.com/devops-ia/aws-ssh-key-lambda-rotation/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/devops-ia%2Faws-ssh-key-lambda-rotation/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33289546,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-21T02:57:32.698Z","status":"ssl_error","status_checked_at":"2026-05-21T02:57:31.990Z","response_time":62,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-lambda","aws-s3","ssh","ssm","terraform"],"created_at":"2024-11-16T18:08:40.181Z","updated_at":"2026-05-21T05:04:26.297Z","avatar_url":"https://github.com/devops-ia.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-ssh-key-lambda-rotation\n\nAWS does not allow you to modify the SSH key of EC2 instances, the option they suggest is to recreate the instance with a new key.\n\nThis repository provides an automated alternative for SSH key rotation with AWS services.\n\nIt allows the generation of Key Pairs and rotation over S3 Buckets, setting the new keys on the machines matching the defined TAG. In addition, it allows key modification when new EC2 machines are provisioned.\n\n## Diagram\n\n![alt text](img/diagram.png \"Title\")\n\n## How to use it\n\n* Execute the script that allows to create the s3 where the TFSTATE will be stored. [./terraform/scripts/create_backend_config.sh](./terraform/scripts/create_backend_config.sh).\n`./terraform/scripts/create_backend_config.sh example-bucket eu-west-1`\n\n* Modify the bucket config and the region in the [terraform_config.tf](terraform/terraform_config.tf) file.\n* Check [terraform.tfvars](terraform/terraform.tvars) file and include your Public IP.\n\n* Deploy code:\n`terraform -chdir=terraform init`\n`terraform -chdir=terraform apply`\n\n* Test ssh instance:\n```sh\nssh -i terraform/rsa.pem ec2-user@\u003cpublic-ip\u003e\n\n       __|  __|_  )\n       _|  (     /   Amazon Linux 2 AMI\n      ___|\\___|___|\n\nhttps://aws.amazon.com/amazon-linux-2/\n12 package(s) needed for security, out of 22 available\nRun \"sudo yum update\" to apply all updates.\n$ \u003e  \n```\n\n* You can run the AWS Kambda code by creating two test events:\nRotate:\n```json\n{\n       \"Records\":[\n          {\n             \"eventSourceARN\":\"\u003carn-sqs-rotate\u003e\"\n          }\n       ]\n    }\n```\n\nDeploy:\n```json\n{\n       \"Records\":[\n          {\n             \"eventSourceARN\":\"\u003carn-sqs-deploy\u003e\"\n          }\n       ]\n    }\n```\n\n* Once executed, download the new keys\n`./terraform/scripts/download_keys.sh \u003crotate-bucket-name\u003e`\n\n* Check ssh instance:\n```sh\nssh -i key_pairs/instance_key.pem ec2-user@\u003cpublic-ip\u003e\nLast login: Fri Jul 22 11:39:22 2022 from XX.XX.XX.XX\n\n       __|  __|_  )\n       _|  (     /   Amazon Linux 2 AMI\n      ___|\\___|___|\n\nhttps://aws.amazon.com/amazon-linux-2/\n12 package(s) needed for security, out of 22 available\nRun \"sudo yum update\" to apply all updates.\n$ \u003e\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdevops-ia%2Faws-ssh-key-lambda-rotation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdevops-ia%2Faws-ssh-key-lambda-rotation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdevops-ia%2Faws-ssh-key-lambda-rotation/lists"}