Skip to main content

Unused AWS EC2 Key Pairs Should Be Removed

More Info:​

Unused AWS EC2 key pairs should be decommissioned to follow best practices.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the issue of Unused AWS EC2 Key Pairs Should Be Removed in AWS using AWS console:

  1. Login to AWS console and navigate to the EC2 dashboard.

  2. Click on the "Key Pairs" option from the left-hand side menu.

  3. Review the list of key pairs that are available. Identify the key pairs that are not being used by any instances.

  4. Select the unused key pairs and click on "Actions" button.

  5. From the drop-down menu, select "Delete Key Pair".

  6. A confirmation window will appear, click on "Delete" to confirm the deletion of the key pair.

  7. Repeat this process for all unused key pairs.

By following the above steps, you will be able to remediate the issue of Unused AWS EC2 Key Pairs Should Be Removed in AWS using AWS console.

Using CLI

Here are the step-by-step instructions to remediate the issue of unused AWS EC2 Key Pairs using AWS CLI:

  1. Open the AWS CLI on your local machine or EC2 instance.
  2. Use the following command to list all the available key pairs:
aws ec2 describe-key-pairs
  1. Identify the key pairs that are not in use and note down their key pair names.
  2. Use the following command to delete the unused key pairs:
aws ec2 delete-key-pair --key-name <key-pair-name>
  1. Replace <key-pair-name> with the actual name of the key pair you want to delete.
  2. Repeat step 4 for all the unused key pairs.
  3. Verify that the unused key pairs have been removed by running the command in step 2 again.

Note: Before deleting any key pair, make sure it is not being used by any running instances. If it is being used, first remove it from the instance and then delete it.

Using Python

Sure, here are the step-by-step instructions to remediate the misconfiguration of unused AWS EC2 key pairs using Python:

  1. Import the necessary libraries:
import boto3
  1. Create a boto3 EC2 client:
ec2 = boto3.client('ec2')
  1. Retrieve all the key pairs in the AWS account:
key_pairs = ec2.describe_key_pairs()
  1. Loop through the key pairs and check if they are associated with any running instances:
for key_pair in key_pairs['KeyPairs']:
    key_name = key_pair['KeyName']
    instances = ec2.describe_instances(Filters=[{'Name': 'key-name', 'Values': [key_name]}])
    if len(instances['Reservations']) == 0:
        print('Deleting key pair:', key_name)
        ec2.delete_key_pair(KeyName=key_name)
  1. The above code will delete all the unused key pairs in the AWS account.

Note: Please make sure to test the code in a non-production environment before running it in a production environment.

Using Terraform
# Remove this resource block (or remove this key from any for_each/count) to have
# Terraform perform the equivalent of:
#   aws ec2 delete-key-pair --key-name {{asset_label}} --region {{region_code}}

resource "aws_key_pair" "UNUSED_KEY_PAIR_NAME" {
  key_name   = "UNUSED_KEY_PAIR_NAME" # replace with the unused key pair name ({{asset_label}})
  public_key = "SSH_PUBLIC_KEY_MATERIAL"
}

# WARNING: Deleting this resource is irreversible and permanently removes the key pair from AWS.
# WARNING: Before removing it from Terraform, confirm it is not referenced by any EC2 instances
# (running or stopped), launch configurations, or launch templates.
# WARNING: Only the public key in AWS is deleted; local private key files are unaffected.

Removing the aws_key_pair.UNUSED_KEY_PAIR_NAME resource (or the corresponding element from a for_each/count) and running terraform plan should show this key pair only in the destroy (-) section.

Additional Reading:​