<div dir="ltr" style="text-align: left;">
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: 1em 0px; padding-top: 1.5em;">Disable Password-Based Remote Logins for Root</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">Using a fixed root password for a public AMI is a security risk that can quickly become known. Even relying on users to change the password after the first login opens a small window of opportunity for potential abuse.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">To solve this problem, disable password-based remote logins for the root user.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em; margin-bottom: 12px;"><b>To disable password-based remote logins for root</b></div>
<ol style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px;">
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">Open the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/etc/ssh/sshd_config</code> ;file with a text editor and locate the following line:</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">#PermitRootLogin yes</code></pre>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">Change the line to:</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">PermitRootLogin without-password</code></pre>
<div style="line-height: 1.5em;">The location of this configuration file might differ for your distribution, or if you are not running OpenSSH. If this is the case, consult the relevant documentation.</div>
</li>
</ol>
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: 1em 0px; padding-top: 1.5em;">Disable Local Root Access</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">When you work with shared AMIs, a best practice is to disable direct root logins. To do this, log into your running instance and issue the following command:</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #444444; font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">[ec2-user ~]$ <strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">sudo passwd <span>-l</span> root</code></strong></code></pre>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; margin: 0.5em 2.7em 1em; padding: 0px;">
<div style="font-weight: bold; line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Note</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">This command does not impact the use of ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">sudo</code>.</div>
</div>
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: -69px 0px 1em; padding-top: calc(1.5em + 69px);">Remove SSH Host Key Pairs</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">If you plan to share an AMI derived from a public AMI, remove the existing SSH host key pairs located in ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/etc/ssh</code>. This forces SSH to generate new unique SSH key pairs when someone launches an instance using your AMI, improving security and reducing the likelihood of &#8220;man-in-the-middle&#8221; attacks.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">Remove all of the following key files that are present on your system.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px;">
<ul type="disc">
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_dsa_key</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_dsa_key.pub</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_key</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_key.pub</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_rsa_key</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_rsa_key.pub</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_ecdsa_key</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_ecdsa_key.pub</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_ed25519_key</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">ssh_host_ed25519_key.pub</div>
</li>
</ul>
</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">You can securely remove all of these files with the following command.</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #444444; font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">[ec2-user ~]$ <strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">sudo shred -u <span>/etc/ssh/</span>*_key <span>/etc/ssh/</span>*_key.pub</code></strong></code></pre>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;"></div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; margin: 0.5em 2.7em 1em; padding: 0px;">
<div style="font-weight: bold; line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Warning</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Secure deletion utilities such as ;<strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">shred</code></strong> ;may not remove all copies of a file from your storage media. Hidden copies of files may be created by journalling file systems (including Amazon Linux default ext4), snapshots, backups, RAID, and temporary caching. For more information see the ;<strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">shred</code></strong> ;<a href="https://www.gnu.org/software/coreutils/manual/html_node/shred-invocation.html" style="color: #996633; text-decoration-line: none;" target="_blank">documentation</a>.</div>
</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; margin: 0.5em 2.7em 1em; padding: 0px;">
<div style="font-weight: bold; line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Important</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">If you forget to remove the existing SSH host key pairs from your public AMI, our routine auditing process notifies you and all customers running instances of your AMI of the potential security risk. After a short grace period, we mark the AMI private.</div>
</div>
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: 1em 0px; padding-top: 1.5em;">Install Public Key Credentials</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">After configuring the AMI to prevent logging in using a password, you must make sure users can log in using another mechanism.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">Amazon EC2 allows users to specify a public-private key pair name when launching an instance. When a valid key pair name is provided to the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">RunInstances</code> ;API call (or through the command line API tools), the public key (the portion of the key pair that Amazon EC2 retains on the server after a call to ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">CreateKeyPair</code> ;or ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">ImportKeyPair</code>) is made available to the instance through an HTTP query against the instance metadata.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">To log in through SSH, your AMI must retrieve the key value at boot and append it to ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/root/.ssh/authorized_keys</code> ;(or the equivalent for any other user account on the AMI). Users can launch instances of your AMI with a key pair and log in without requiring a root password.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">Many distributions, including Amazon Linux and Ubuntu, use the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">cloud-init</code> ;package to inject public key credentials for a configured user. If your distribution does not support<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">cloud-init</code>, you can add the following code to a system start-up script (such as ;<code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/etc/rc.local</code>) to pull in the public key you specified at launch for the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">root</code> ;user.</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); color: #444444; font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">if [ ! -d /root/.ssh ] ; then<br /> mkdir -p /root/.ssh<br /> chmod 700 /root/.ssh<br />fi<br /># Fetch public key using HTTP<br />curl http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key >; /tmp/my-key<br />if [ $? -eq 0 ] ; then<br /> cat /tmp/my-key >;>; /root/.ssh/authorized_keys<br /> chmod 700 /root/.ssh/authorized_keys<br /> rm /tmp/my-key<br />fi</code></pre>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">This can be applied to any user account; you do not need to restrict it to ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">root</code>.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; margin: 0.5em 2.7em 1em; padding: 0px;">
<div style="font-weight: bold; line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Note</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Rebundling an instance based on this AMI includes the key with which it was launched. To prevent the key&#8217;s inclusion, you must clear out (or delete) the<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">authorized_keys</code> ;file or exclude this file from rebundling.</div>
</div>
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: 1em 0px; padding-top: 1.5em;">Disabling sshd DNS Checks (Optional)</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">Disabling sshd DNS checks slightly weakens your sshd security. However, if DNS resolution fails, SSH logins still work. If you do not disable sshd checks, DNS resolution failures prevent all logins.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px;">
<div style="line-height: 1.5em; margin-bottom: 12px;"><b>To disable sshd DNS checks</b></div>
<ol>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">Open the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/etc/ssh/sshd_config</code> ;file with a text editor and locate the following line:</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">#UseDNS yes</code></pre>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">Change the line to:</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">UseDNS no</code></pre>
</li>
</ol>
</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; margin: 0.5em 2.7em 1em; padding: 0px;">
<div style="font-weight: bold; line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Note</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">The location of this configuration file can differ for your distribution or if you are not running OpenSSH. If this is the case, consult the relevant documentation.</div>
</div>
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: 1em 0px; padding-top: 1.5em;">Identify Yourself</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">Currently, there is no easy way to know who provided a shared AMI, because each AMI is represented by an account ID.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">We recommend that you post a description of your AMI, and the AMI ID, in the ;<a href="https://forums.aws.amazon.com/forum.jspa?forumID=30" style="color: #996633; text-decoration-line: none;" target="_blank">Amazon EC2 forum</a>. This provides a convenient central location for users who are interested in trying new shared AMIs. You can also post the AMI to the ;<a href="http://aws.amazon.com/" style="color: #996633; text-decoration-line: none;" target="_blank">Amazon Machine Images (AMIs)</a> ;page.</div>
<h2 style="background-color: white; color: #cc6600; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 18px; margin: 1em 0px; padding-top: 1.5em;">Protect Yourself</h2>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">The previous sections described how to make your shared AMIs safe, secure, and usable for the users who launch them. This section describes guidelines to protect yourself from the users of your AMI.</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; line-height: 1.5em;">We recommend against storing sensitive data or software on any AMI that you share. Users who launch a shared AMI might be able to rebundle it and register it as their own. Follow these guidelines to help you to avoid some easily overlooked security risks:</div>
<div style="background-color: white; color: #444444; font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px;">
<ul type="disc">
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">We recommend using the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">--exclude ;<em style="color: red;"><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">directory</code></em></code> ;option on ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">ec2-bundle-vol</code> ;to skip any directories and subdirectories that contain secret information that you would not like to include in your bundle. In particular, exclude all user-owned SSH public/private key pairs and SSH ;<strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">authorized_keys</code></strong> ;files when bundling the image. The Amazon public AMIs store these in ;<code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/root/.ssh</code> ;for the ;<code copy="true" style="font-family: ";Courier New";, Courier, mono; overflow: auto;">root</code> ;account, and<code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">/home/<em style="color: red;"><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">user_name</code></em>/.ssh/</code> ;for regular user accounts. For more information, see ;<a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-up-ami-tools.html#ami-bundle-vol" style="color: #996633; text-decoration-line: none;">ec2-bundle-vol</a>.</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">Always delete the shell history before bundling. If you attempt more than one bundle upload in the same AMI, the shell history contains your secret access key. The following example should be the last command executed before bundling from within the instance.</div>
<pre style="background-color: #f0f0f0; border-radius: 3px; border: 1px solid rgb(225, 225, 232); font-family: ";Courier New";, Courier, mono; font-size: 14px; line-height: normal; overflow: auto; padding: 0.5em;"><div style="font-family: ";Open Sans";, ";Lucida Grande";, ";Helvetica Neue";, Arial; font-size: 16px; overflow: hidden;"><br /><div style="background-color: #dedede; background-image: linear-gradient(white, rgb(222, 222, 222)); border-color: rgb(222, 222, 222) rgb(197, 197, 197) rgb(197, 197, 197); border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: none; border-image-width: initial; border-radius: 4px; border-style: solid; border-width: 1px; clear: both; cursor: pointer; float: right; font-size: 12px; font-weight: 700; margin: 0px; padding: 2px; text-align: center;"><br />Copy</div><br /></div><br /><code style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; display: block; font-family: ";Courier New";, Courier, mono; overflow: auto; padding: 0.5em; text-size-adjust: none;">[ec2-user ~]$ <strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">shred -u ~/.*<span>history</span></code></strong></code></pre>
<div style="margin: 0.5em 2.7em 1em; padding: 0px;">
<div style="font-weight: bold; line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Warning</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">The limitations of ;<strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">shred</code></strong> ;described in the warning above apply here as well.</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Be aware that bash writes the history of the current session to the disk on exit. If you log out of your instance after deleting ;<strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">~/.bash_history</code></strong>, and then log back in, you will find that ;<strong><code style="font-family: ";Courier New";, Courier, mono; overflow: auto;">~/.bash_history</code></strong> ;has been re-created and contains all of the commands executed during your previous session.</div>
<div style="line-height: 1.5em; margin-top: 0.5em; padding: 0px;">Other programs besides bash also write histories to disk, Use caution and remove or exclude unnecessary dot-files and dot-directories.</div>
</div>
</li>
<li style="line-height: 1.5em;">
<div style="line-height: 1.5em;">Bundling a running instance requires your private key and X.509 certificate. Put these and other credentials in a location that is not bundled (such as the instance store).</div>
</li>
</ul>
</div>
</div>

The Cyber Security, Compliance & Cloud
Cyber Security | Digital Transformation | Cloud Computing
