aws / aws/aws-cli

`aws ec2-instance connect ssh` fails on Windows

Open
#9,114 17 comments 5 reactions 0 assignees View on GitHub
bug ec2-instance-connect p2 potential-regression
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

On Windows, the following command

```
aws ec2-instance-connect ssh --os-user XXXX --instance-id i-XXXXXXXXX
```
fails because of the (temporary) key file permissions.

### Regression Issue

- [X] Select this option if this issue appears to be a regression.

### Expected Behavior

Connect to the remote instance.

### Current Behavior

The complete error (with the user and instance id anonymized) is:

```
Bad permissions. Try removing permissions for user: \\OWNER RIGHTS (S-1-3-4) on file C:/Users/XXXX/AppData/Local/Temp/tmp3cja4v_s/private-key.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'C:\\Users\\XXXX\\AppData\\Local\\Temp\\tmp3cja4v_s\\private-key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "C:\\Users\\XXXX\\AppData\\Local\\Temp\\tmp3cja4v_s\\private-key": bad permissions
```
Note that, after the command fails, the key file (`private-key`) and its folder (`C:\Users\XXXX\AppData\Local\Temp\tmp3cja4v_s`) are missing, I presume they are created "on the fly" by the command and then removed, so there is no (easy) way to examine the file and its permission.

### Reproduction Steps

* Create a VPC, with public and private subnets
* Create a EC2 Instance Connect Endpoint
* Create EC2 instance on the private subnet.
* Get the EC2 instance ID
* Issue the following command:
```
aws ec2-instance-connect ssh --os-user XXXX --instance-id i-XXXXXXXXX
```

### Possible Solution

I suspect that the temporary private key created for the connection does not have the correct permissions.
The solution is to downgrade to a previous version of the CLI that does not present the regression.

### Additional Information/Context

This appears to be a regression, version up to 2.17.0 work as expected, while versions 2.17.65, 2.18.0, 2.20.0 and 2.22.0 fail with the above error.
I did not check all the minor 2.17 versions, but apparently the regression appeared between 2.17.0 and 2.17.65.

### CLI version used

aws-cli/2.17.65 Python/3.12.6 Windows/11 exe/AMD64

### Environment details (OS name and version, etc.)

Windows 11 Pro, version 23H2 - OS Build 22631.4460

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.