Creating an AWS EC2 Key Pair and Connecting to a Terraform-Provisioned EC2 Instance via SSH on Windows

When provisioning EC2 instances with Terraform, one of the most important steps is attaching an AWS Key Pair so that you can securely SSH into the instance after deployment. This guide walks through the exact process I used on Windows with Terraform and VS Code.

Prerequisites

• AWS Account
• Terraform installed
• VS Code
• Existing Terraform project that provisions an EC2 instance
• Windows PowerShell

Step 1: Create an AWS Key Pair

Navigate to:

AWS Console → EC2 → Key Pairs

Click Create Key Pair and configure:

• Name: soch-dev-server-key-pair-tf
• Key Pair Type: RSA
• Private Key File Format: .pem

After creation, AWS automatically downloads the private key:

soch-dev-server-key-pair-tf.pem

Store the file in your Terraform project:

Lab Project Folder Structure for Terraform 

soch-terraform-project/
├── keys/
  ├── soch-dev-server-key-pair-tf
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── terraform.tfvars
│   │   └── outputs.tf
│   │
│   ├── stage/
│   └── prod/
│
├── modules/
│   ├── ec2/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   │
│   └── security-group/
│       ├── main.tf
│       ├── variables.tf
│       └── outputs.tf
│
└── backend.tf

Step 2: Attach the Key Pair to the EC2 Instance in Terraform

Since the key pair already exists in AWS, Terraform only needs the key pair name.

modules/ec2/variables.tf

variable "instance_type" {}
variable "ami_id" {}
variable "sg_id" {}
##Add the Below code 
variable "key_name" {
  description = "AWS Key Pair Name"
  type        = string
}

modules/ec2/main.tf

Inside the EC2 resource:

resource "aws_instance" "this" {
  ami = var.ami_id
  instance_type = var.instance_type
  vpc_security_group_ids = [var.sg_id]
  tags = {
    name = "soch-dev-server"
  }
  #Add this line 
  key_name = var.key_name
}

environments/dev/variables.tf

variable "aws_region" {}
variable "instance_type" {}
variable "ami_id" {}
#Add the below code 
variable "key_name" {
  type = string
}

environments/dev/terraform.tfvars

aws_region    = "us-east-2"
instance_type = "t3.micro"
ami_id        = "ami-0fe18bc3cfa53a248"
#Add the below line
key_name = "soch-dev-server-key-pair-tf"

environments/dev/main.tf

Pass the variable into the module:

terraform {
  required_version = ">=1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~>5.0"
    }
  }
}
provider "aws" {
  region  = var.aws_region
  profile = "uzair-aws-admin"
}

data "aws_vpc" "default" {
  default = true
}

module "security_group" {
  source  = "../../modules/security-groups"
  sg_name = "soch-dev-sg"
  vpc_id  = data.aws_vpc.default.id
}
#This is the EC2 Module in which we want to add the variable
module "ec2" {
  source        = "../../modules/ec2"
  ami_id        = var.ami_id
  instance_type = var.instance_type
  sg_id         = module.security_group.sg_id
  #Add this below line 
   key_name = var.key_name
}

Step 3: Deploy the Infrastructure

Navigate to the environment directory:

cd environments/dev

Run:

terraform init
terraform plan
terraform apply

Terraform provisions the EC2 instance and associates the AWS Key Pair.

Step 4: Obtain the Public IP

After deployment, retrieve the public IP:

terraform output

Example:

instance_id = "i-0fb02c20ee747ca9b"
public_ip   = "3.22.101.94"

Step 5: Verify Security Group Configuration

Ensure the EC2 Security Group allows inbound SSH traffic on port 22.

Example inbound rule:

TypeProtocolPortSourceSSHTCP220.0.0.0/0

For production environments, restrict access to your own public IP instead of allowing access from everywhere.

Step 6: Attempt SSH Connection

From the root of the Terraform project:

ssh -i .\keys\soch-dev-server-key-pair-tf.pem ubuntu@3.22.101.94

At this point, Windows may display:

WARNING: UNPROTECTED PRIVATE KEY FILE!
Permissions are too open.

This occurs because Windows file permissions are more permissive than what OpenSSH allows for private keys.

Step 7: Fix PEM File Permissions on Windows

Run the following commands in PowerShell:

icacls ".\keys\soch-dev-server-key-pair-tf.pem" /inheritance:r
icacls ".\keys\soch-dev-server-key-pair-tf.pem" /grant:r "$($env:USERNAME):(R)"

Inspect current permissions:

icacls ".\keys\soch-dev-server-key-pair-tf.pem"

If the output still contains:

NT AUTHORITY\Authenticated Users

remove it:

icacls ".\keys\soch-dev-server-key-pair-tf.pem" /remove "Authenticated Users"

If a Users group exists, remove it as well:

icacls ".\keys\soch-dev-server-key-pair-tf.pem" /remove "Users"

Verify permissions again:

icacls ".\keys\soch-dev-server-key-pair-tf.pem"

The private key should now be accessible only by the current user and required system accounts.

Step 8: Connect Successfully via SSH

Run:

ssh -i .\keys\soch-dev-server-key-pair-tf.pem ubuntu@3.22.101.94

The first time, SSH prompts you to trust the host:

The authenticity of host '3.22.101.94' can't be established.
Are you sure you want to continue connecting?

Type:

yes

After the permissions issue is resolved, the SSH session is established successfully.

Key Takeaway

A common misconception is that Terraform needs the .pem file. In reality:

• Terraform only needs the AWS Key Pair name.
• AWS stores the public key.
• The .pem file remains on your local machine.
• SSH uses the .pem file after the EC2 instance is created.

The overall workflow is:

AWS Key Pair
        │
        ▼
Terraform EC2 Configuration
        │
        ▼
EC2 Instance Created
        │
        ▼
Use PEM File Locally
        │
        ▼
SSH into EC2

By following these steps, I successfully provisioned an EC2 instance using Terraform and connected to it securely from a Windows machine using VS Code and PowerShell.