<p>Based on <a href="https://devops.stackexchange.com/a/3828/3">@Vish answer</a>, I've created the following shell script:</p>

<pre><code>#/usr/bin/env bash
# Script to show password data of the EC2 instance.
[ $# -eq 0 ] &amp;&amp; { echo "Usage: $0 instance_id ..."; exit; }
keyname=$(aws ec2 describe-instances --query 'Reservations[].Instances[].KeyName' --output text --instance-ids $1)
pemfile=$(find ~/.ssh -name "*$keyname*.pem" -print -quit)
if [ -z "$pemfile" ]; then
  aws ec2 get-password-data --instance-id $1
else
  aws ec2 get-password-data --instance-id $1 --priv-launch-key $pemfile
fi
</code></pre>

<p>which aims to decrypt the password based on the key pair name. By default it's looking for the PEM file in user's <code>~/.ssh</code> folder.</p>

<p>Usage:</p>

<pre><code>./show_ec2_password_data.sh i-instance_id
</code></pre>

CC BY-SA 3.0
2018-04-09T12:41:02.910Z
2018-04-09T12:41:02.910Z
kenorb
<p>For a given instance, you would first use <code>aws ec2 describe-instances</code> to get the information JSON for your instance.</p>

<p>The information also contains the keypair name used to create that instance.</p>

<p>E.g. for an instance <code>i-0e2x8xd7xxx</code>  (Note: I use the awesome tool <code>jq</code> to do JSON parsing but you can use any other solution)</p>

<pre><code>aws ec2 describe-instances --instance-ids i-0e2x8xd7xxx | jq '.Reservations[].Instances[].KeyName'
</code></pre>

<p>Output:</p>

<pre><code>"my_key_name"
</code></pre>

<p>You can store that in a variable, say <code>$keypair_name</code> and then pass it into your <code>aws ec2 get-password-data</code> command.</p>

<p>You would also need to pass in the path on your machine where your keypairs are located e.g. <code>$keypair_path</code>.</p>

<p>For example:</p>

<pre><code>aws ec2 get-password-data --priv-launch-key $keypair_path/$keypair_name .....
</code></pre>

CC BY-SA 3.0
2018-04-07T04:07:00.053Z
2018-04-07T04:12:47.630Z
2018-04-07T04:12:47.630Z
Vish
<p>I'm aware of <code>get-password-data</code> command which can display PasswordData data like:</p>

<pre><code>$ aws ec2 get-password-data --instance-id i-0123456789
{
    "InstanceId": "i-0123456789",
    "PasswordData": "\r\nAOh...xg==\r\n",
    "Timestamp": "2018-03-27T16:52:04.000Z"
}
</code></pre>

<p>however I'd like to know which <em>Key pair name</em> was used to launch the instance, so I can pass it using <code>--priv-launch-key</code> in order to decrypt the password.</p>

<amazon-ec2><aws-cli>
How to find out the used Key pair name via AWS CLI?
kenorb
# How to find out the used Key pair name via AWS CLI?

(Asked by: username_0 on 2018-04-06)

I'm aware of get-password-data command which can display PasswordData data like:
$ aws ec2 get-password-data --instance-id i-0123456789
{
    "InstanceId": "i-0123456789",
    "PasswordData": "\r\nAOh...xg==\r\n",
    "Timestamp": "2018-03-27T16:52:04.000Z"
}

however I'd like to know which Key pair name was used to launch the instance, so I can pass it using --priv-launch-key in order to decrypt the password.

**Tags:** amazon-ec2, aws-cli


---

## 2 answers

### Answer by username_1 on 2018-04-07. Score: 7 | Accepted answer

For a given instance, you would first use aws ec2 describe-instances to get the information JSON for your instance.
The information also contains the keypair name used to create that instance.
E.g. for an instance i-0e2x8xd7xxx  (Note: I use the awesome tool jq to do JSON parsing but you can use any other solution)
aws ec2 describe-instances --instance-ids i-0e2x8xd7xxx | jq '.Reservations[].Instances[].KeyName'

Output:
"my_key_name"

You can store that in a variable, say $keypair_name and then pass it into your aws ec2 get-password-data command.
You would also need to pass in the path on your machine where your keypairs are located e.g. $keypair_path.
For example:
aws ec2 get-password-data --priv-launch-key $keypair_path/$keypair_name .....


---

### Answer by username_0 on 2018-04-09. Score: 4

Based on @username_1 answer, I've created the following shell script:
#/usr/bin/env bash
# Script to show password data of the EC2 instance.
[ $# -eq 0 ] && { echo "Usage: $0 instance_id ..."; exit; }
keyname=$(aws ec2 describe-instances --query 'Reservations[].Instances[].KeyName' --output text --instance-ids $1)
pemfile=$(find ~/.ssh -name "*$keyname*.pem" -print -quit)
if [ -z "$pemfile" ]; then
  aws ec2 get-password-data --instance-id $1
else
  aws ec2 get-password-data --instance-id $1 --priv-launch-key $pemfile
fi

which aims to decrypt the password based on the key pair name. By default it's looking for the PEM file in user's ~/.ssh folder.
Usage:
./show_ec2_password_data.sh i-instance_id


---

