https://github.com/devops-ia/aws-ssh-key-lambda-rotation
SSH key rotation of AWS EC2 instances with AWS Lambda and AWS System Manager
https://github.com/devops-ia/aws-ssh-key-lambda-rotation
aws aws-lambda aws-s3 ssh ssm terraform
Last synced: 9 months ago
JSON representation
SSH key rotation of AWS EC2 instances with AWS Lambda and AWS System Manager
- Host: GitHub
- URL: https://github.com/devops-ia/aws-ssh-key-lambda-rotation
- Owner: devops-ia
- License: mpl-2.0
- Created: 2022-03-31T09:26:17.000Z (almost 4 years ago)
- Default Branch: main
- Last Pushed: 2025-07-02T06:41:48.000Z (9 months ago)
- Last Synced: 2025-07-02T07:41:02.972Z (9 months ago)
- Topics: aws, aws-lambda, aws-s3, ssh, ssm, terraform
- Language: HCL
- Homepage:
- Size: 565 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# aws-ssh-key-lambda-rotation
AWS does not allow you to modify the SSH key of EC2 instances, the option they suggest is to recreate the instance with a new key.
This repository provides an automated alternative for SSH key rotation with AWS services.
It allows the generation of Key Pairs and rotation over S3 Buckets, setting the new keys on the machines matching the defined TAG. In addition, it allows key modification when new EC2 machines are provisioned.
## Diagram
## How to use it
* Execute the script that allows to create the s3 where the TFSTATE will be stored. [./terraform/scripts/create_backend_config.sh](./terraform/scripts/create_backend_config.sh).
`./terraform/scripts/create_backend_config.sh example-bucket eu-west-1`
* Modify the bucket config and the region in the [terraform_config.tf](terraform/terraform_config.tf) file.
* Check [terraform.tfvars](terraform/terraform.tvars) file and include your Public IP.
* Deploy code:
`terraform -chdir=terraform init`
`terraform -chdir=terraform apply`
* Test ssh instance:
```sh
ssh -i terraform/rsa.pem ec2-user@
__| __|_ )
_| ( / Amazon Linux 2 AMI
___|\___|___|
https://aws.amazon.com/amazon-linux-2/
12 package(s) needed for security, out of 22 available
Run "sudo yum update" to apply all updates.
$ >
```
* You can run the AWS Kambda code by creating two test events:
Rotate:
```json
{
"Records":[
{
"eventSourceARN":""
}
]
}
```
Deploy:
```json
{
"Records":[
{
"eventSourceARN":""
}
]
}
```
* Once executed, download the new keys
`./terraform/scripts/download_keys.sh `
* Check ssh instance:
```sh
ssh -i key_pairs/instance_key.pem ec2-user@
Last login: Fri Jul 22 11:39:22 2022 from XX.XX.XX.XX
__| __|_ )
_| ( / Amazon Linux 2 AMI
___|\___|___|
https://aws.amazon.com/amazon-linux-2/
12 package(s) needed for security, out of 22 available
Run "sudo yum update" to apply all updates.
$ >
```