`aws ec2-instance connect ssh` fails on Windows
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
On Windows, the following command
```
aws ec2-instance-connect ssh --os-user XXXX --instance-id i-XXXXXXXXX
```
fails because of the (temporary) key file permissions.
### Regression Issue
- [X] Select this option if this issue appears to be a regression.
### Expected Behavior
Connect to the remote instance.
### Current Behavior
The complete error (with the user and instance id anonymized) is:
```
Bad permissions. Try removing permissions for user: \\OWNER RIGHTS (S-1-3-4) on file C:/Users/XXXX/AppData/Local/Temp/tmp3cja4v_s/private-key.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'C:\\Users\\XXXX\\AppData\\Local\\Temp\\tmp3cja4v_s\\private-key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "C:\\Users\\XXXX\\AppData\\Local\\Temp\\tmp3cja4v_s\\private-key": bad permissions
```
Note that, after the command fails, the key file (`private-key`) and its folder (`C:\Users\XXXX\AppData\Local\Temp\tmp3cja4v_s`) are missing, I presume they are created "on the fly" by the command and then removed, so there is no (easy) way to examine the file and its permission.
### Reproduction Steps
* Create a VPC, with public and private subnets
* Create a EC2 Instance Connect Endpoint
* Create EC2 instance on the private subnet.
* Get the EC2 instance ID
* Issue the following command:
```
aws ec2-instance-connect ssh --os-user XXXX --instance-id i-XXXXXXXXX
```
### Possible Solution
I suspect that the temporary private key created for the connection does not have the correct permissions.
The solution is to downgrade to a previous version of the CLI that does not present the regression.
### Additional Information/Context
This appears to be a regression, version up to 2.17.0 work as expected, while versions 2.17.65, 2.18.0, 2.20.0 and 2.22.0 fail with the above error.
I did not check all the minor 2.17 versions, but apparently the regression appeared between 2.17.0 and 2.17.65.
### CLI version used
aws-cli/2.17.65 Python/3.12.6 Windows/11 exe/AMD64
### Environment details (OS name and version, etc.)
Windows 11 Pro, version 23H2 - OS Build 22631.4460
Contributor guide
Assessment
This issue has not been assessed yet.