13

How to solve this?

# I used this command to create the key with a password
$ ssh-keygen -b 2048 -t rsa -C "awsfrankfurt" -f ~/.ssh/awsfrankfurt

# Then when I try to import it into AWS EC2, the error appears:
$ aws --region eu-central-1 ec2 import-key-pair \
    --key-name "awsfrankfurt" \
    --public-key-material ~/.ssh/awsfrankfurt

An error occurred (InvalidKey.Format) when the ImportKeyPair operation: 
Key is not in valid OpenSSH public key format
1

3 Answers 3

32

AWS only supports RSA keypairs, it does not support DSA, ECDSA or Ed25519 keypairs. If you try to upload a non RSA public key you will get this error.

This is documented here:

Amazon EC2 does not accept DSA keys. Make sure your key generator is set up to create RSA keys.

The error message is misleading as you can upload a valid non RSA key and get the error:

Error import KeyPair: InvalidKey.Format: Key is not in valid OpenSSH public key format

This answer should be useful for people who find this page after searching for this error message.

2
  • Isn't that what the asker has created, an RSA key? Commented Dec 9, 2020 at 0:19
  • 1
    It is. My answer is directed at people who get to this page when googling the error message (as stated on the final line). Thanks to google there are times when the majority of people who get to a SO page are interested in the answer to a different problem rather than the stated question, this is one of those times.
    – htaccess
    Commented Jan 6, 2021 at 2:31
11

Create your key and then when calling aws's --public-key-material argument, call it with file:// in front of your key path.

Example:

$ aws --region eu-central-1 ec2 import-key-pair \
    --key-name "awsfrankfurt" \
    --public-key-material file://~/.ssh/awsfrankfurt  # <-- this

This is a weird issue, because, file:// prefix is usually used for Windows, but, here with aws, it applies to unix based terminals as well.

3
  • What else could cause the same error message if one prefixes the file:// before the key path? Commented Jun 8, 2018 at 18:26
  • 1
    @GusCrawford: Trying to use a non RSA key could also cause the error, see my answer.
    – htaccess
    Commented Sep 21, 2018 at 0:25
  • Turns out, with "modern" aws-cli (AWS CLI 2.2.38) what is required is NOT file:// but fileb:// (note the 'b'). If the former is used, one still gets the error message in the title of this article. With fileb:// the key is imported as expected. It's easy to miss if not expecting the 'b'. It's correct in the doc: awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/…
    – hjonez
    Commented Sep 17, 2021 at 20:16
0

I ran into the same situation when I was creating an aws keypair using pulumi. Strangely, it worked when I used the content of the public key rather than the .pub file.

So here is what I changed in my code.

from :

aws.ec2.KeyPair("keypair", public_key="~/.ssh/mykey.pub")

to:

aws.ec2.KeyPair("keypair", public_key="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9u37J5tfzmeA8INBCcFSPKnUN8GIjYFdPOOCn8AjUC5iTJX/7TWd3pZ42Z++RCIlvBvKkH7LL1p"

Changed from path to .pub file to the content of .pub file

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.