Create a new AWS user with ssh access

You can find part of the instructions on the AWS tutorial page. Unlike AWS page this post is complete: From creating the key-pair in your local machine or extracting the public key from a private key if you already have one, to create the user in AWS, add the public key to allow the access for the new user, and give sudo permissions to the new user.

In your local machine:

1. Create a pair public-private key (RSA). If you add a passphrase it will be requested to you when extracting the public key and when accessing the AWS instance:

   ssh-keygen -t rsa

   >> Generating public/private rsa key pair.
   >> Enter file in which to save the key (/path/.ssh/id_rsa):
   >> Enter passphrase (empty for no passphrase): 
   >> Enter same passphrase again: 
   >> Your identification has been saved in ./id_rsa.pem.
   >> Your public key has been saved in ./id_rsa.pem.pub.
   >> The key fingerprint is:
   >> SHA256:csod8A09MLbQ3eYLovdPBBNRgZdCoerdxBFbwFXhUyk
   >> The key's randomart image is:
   +---[RSA 2048]----+
   |      ..++BO=+o.o|
   |       o.*===E o |
   |      . + B=  +  |
   |       +.+.=.  . |
   |      o.S.+...   |
   |     o.*.+ ..    |
   |      +.o.. .    |
   |          ..     |
   |           ..    |
   +----[SHA256]-----+
   

2. Extract the public key from a private key if you already have one:

   ssh-keygen -y

   >> Enter file in which the key is (/path/.ssh/id_rsa):
   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
   @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
   Permissions 0644 for './id_rsa.pem' are too open.
   It is required that your private key files are NOT accessible by others.
   This private key will be ignored.
   Load key "./id_rsa.pem": bad permissions

   If this error prompts is because the file has wrong permissions, you can fix it with the following command:

   chmod 400 id_rsa.pem 
   

   If everything works you would get the public key:

   ssh-keygen -y

   >> Enter file in which the key is (/path/.ssh/id_rsa): 
   >> Enter passphrase: 
   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgn+YPttf9ozLZig8fm5Vok+x1Ml96ndzUJoJt/RDSkZpXac2XQE+8wWO53Braw5hdTusz06Id+fqOANB0mxzaW8YG1aEL+/WtODx0s2eYuF3AV+4se0KR59VenmSNpMEsXR3CjABGHdN9fVdphkUU4KtjAmWG2u2IMTeTiatA6p1jDXKgqbmbkGj4f4y+Wpd3qrMvEBHVOumB8w7pFb1t9JnuRC46/yaHA72n6sYxIoeAD/FL0qHXe3xQsla2XXYyxUK8rpzAVfsFrPF/owM4NFnlF5szyNaDD4KdrCuznIlMyEK1JhFc6LDDAlVrenZZ8ezlDQ9BpWvEvjawKDOR
   

In your AWS instance:

1. ssh to your instance

   ssh -i credentials.pem ec2-user@ec2-xx-xxx-xx-xxx.us-east-2.compute.amazonaws.com
   

2. Create the new user

   sudo adduser new_user
   sudo su new_user
   cd
   mkdir .ssh
   chmod 700 .ssh
   cd
   touch .ssh/authorized_keys
   chmod 600 .ssh/authorized_keys
   

3. Copy the public key you have generated in the step 1 in authorized_keys

   vim .ssh/authorized_keys 
   

   Copy, paste, and save the full public key including the ssh-rsa. In this example:

   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgn+YPttf9ozLZig8fm5Vok+x1Ml96ndzUJoJt/RDSkZpXac2XQE+8wWO53Braw5hdTusz06Id+fqOANB0mxzaW8YG1aEL+/WtODx0s2eYuF3AV+4se0KR59VenmSNpMEsXR3CjABGHdN9fVdphkUU4KtjAmWG2u2IMTeTiatA6p1jDXKgqbmbkGj4f4y+Wpd3qrMvEBHVOumB8w7pFb1t9JnuRC46/yaHA72n6sYxIoeAD/FL0qHXe3xQsla2XXYyxUK8rpzAVfsFrPF/owM4NFnlF5szyNaDD4KdrCuznIlMyEK1JhFc6LDDAlVrenZZ8ezlDQ9BpWvEvjawKDOR
   

   Press ESC and type wq to white and quit the vim editor.
4. You can give sudo access to the new user without the need of a password:

   sudo vim /etc/sudoers
   

   Add the following line in the shudders file:

   new_user ALL=(ALL) NOPASSWD:ALL
   

5. Now you can ssh from your computer to AWS with the new user instead of the ec2-user:

   ssh -i id_rsa.pem new_user@ec2-xx-xxx-xx-xxx.us-east-2.compute.amazonaws.com
   

   >>Enter passphrase for key 'id_rsa.pem': 
   Last login: Wed Apr 11 17:14:29 2018
   
          __|  __|_  )
          _|  (     /   Amazon Linux AMI
         ___|\___|___|
   
   https://aws.amazon.com/amazon-linux-ami/2017.09-release-notes/
   [new_user@ip-xxx-xx-xx-xxx ~]$