Getting in: SSH and key pairs

A terminal on a machine you will never see

Your instance is running in a Virginia data center. You administer it with SSH (Secure Shell), a protocol that gives you an encrypted terminal session on a remote machine. Everything you type runs there, not on your laptop.

SSH logins to EC2 use a key pair instead of a password:

• a public key, which AWS places on the instance at launch, and
• a private key, a file only you hold (like my-key.pem).

The server issues a mathematical challenge that only the private key can answer, so nothing guessable ever crosses the wire. AWS keeps no copy of your private key. Lose the file and AWS cannot resend it, which is very on-brand for lesson 2-1: AWS avoids holding secrets it does not need.

The commands, end to end

Launching and connecting looks like this (shown for reading, not running, since it needs a real account):

# launch: which image, which size, which key, which firewall
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --key-name my-key \
  --security-group-ids sg-0123456789

# connect: private key file + username + the instance's public IP
ssh -i my-key.pem ubuntu@54.210.167.204

After the ssh command your prompt belongs to the instance. From there it is the deployment world you already know: install Docker, pull your image, run the container. Note the launch flags map one-to-one to this unit: AMI, instance type, key pair, and a security group, which is the next lesson.