Package: cdk-ec2-key-pair
CDK EC2 Key PairAWS CDKL3 construct for managingEC2 Key Pairs.CloudFormation doesn't directly support creation of EC2 Key Pairs. This construct provides an easy interface for creating Key Pairs through acustom CloudFormation resource. The private key is stored inAWS Secrets Manager.InstallationThis package has peer dependencies, which need to be installed along in the expected version.For TypeScript/NodeJS, add these to yourdependenciesinpackage.json. For Python, add these to yourrequirements.txt:cdk-ec2-key-pairaws-cdk-lib (^2.0.0)constructs (^10.0.0)CDK compatibilityVersion 3.x is compatible with the CDK v2.Version 2.x is compatible with the CDK v1. There won't be regular updates for this.Usageimportcdk=require('aws-cdk-lib');import{Construct}from'constructs';import{KeyPair}from'cdk-ec2-key-pair';//...//CreatetheKeyPairconstkey=newKeyPair(this,'A-Key-Pair',{name:'a-key-pair',description:'This is a Key Pair',storePublicKey:true,//bydefaultthepublickeywillnotbestoredinSecretsManager});//Grantreadaccesstotheprivatekeytoaroleoruserkey.grantReadOnPrivateKey(someRole)//Grantreadaccesstothepublickeytoanotherroleoruserkey.grantReadOnPublicKey(anotherRole)//UseKeyPaironanEC2instancenewec2.Instance(this,'An-Instance',{keyName:key.keyPairName,//...})The private (and optionally the public) key will be stored in AWS Secrets Manager. The secret names by default are prefixed withec2-ssh-key/. The private key is suffixed with/private, the public key is suffixed with/public. So in this example they will be stored asec2-ssh-key/a-key-pair/privateandec2-ssh-key/a-key-pair/public.To download the private key via AWS cli you can run:awssecretsmanagerget-secret-value\--secret-idec2-ssh-key/a-key-pair/private\--querySecretString\--outputtextTag supportThe construct supports tagging:cdk.Tags.of(key).add('someTag','some value');We also use tags to restrict update/delete actions to those, the construct created itself. The Lambda function, which backs the custom CFN resource, is not able to manipulate other keys/secrets. The tag we use for identifying these resources isCreatedByCfnCustomResourcewith valueCFN::Resource::Custom::EC2-Key-Pair.UpdatesSince an EC2 KeyPair cannot be updated, you cannot change any property related to the KeyPair. The code has checks in place which will prevent any attempt to do so. If you try, the stack will end in a failed state. In that case you can safely continue the rollback in the AWS console and ignore the key resource.You can, however, change properties that only relate to the secrets. These are the KMS keys used for encryption, thesecretPrefix,descriptionandremoveKeySecretsAfterDays.EncryptionSecrets in the AWS Secrets Manager by default are encrypted with the keyalias/aws/secretsmanager.To use a custom KMS key you can pass it to the Key Pair:constkmsKey=newkms.Key(this,'KMS-key');constkeyPair=newKeyPair(this,'A-Key-Pair',{name:'a-key-pair',kms:kmsKey,});This KMS key needs to be created in the same stack. You cannot use a key imported via ARN, because the keys access policy will need to be modified.To use different KMS keys for the private and public key, use thekmsPrivateKeyandkmsPublicKeyinstead:constkmsKeyPrivate=newkms.Key(this,'KMS-key-private');constkmsKeyPublic=newkms.Key(this,'KMS-key-public');constkeyPair=newKeyPair(this,'A-Key-Pair',{name:'a-key-pair',kmsPrivateKey:kmsKeyPrivate,kmsPublicKey:kmsKeyPublic});Importing public keyYou can create a key pair by importing the public key. Obviously, in this case the private key won't be available in secrets manager.The public key has to be in OpenSSH format.newKeyPair(this,'Test-Key-Pair',{name:'imported-key-pair',publicKey:'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuMmbK...'});Using the key pair for CloudFront signed url/cookiesYou can use this library for generating keys for CloudFront signed url/cookies.Make sure to setpublicKeyFormattoPublicKeyFormat.PEMas that is the format required for CloudFront.
You also have to setexposePublicKeytotrueso you can actually get the public key.constkey=newKeyPair(this,'Signing-Key-Pair',{name:'CFN-signing-key',exposePublicKey:true,storePublicKey:true,publicKeyFormat:PublicKeyFormat.PEM});constpubKey=newcloudfront.PublicKey(this,'Signing-Public-Key',{encodedKey:key.publicKeyValue,});consttrustedKeyGroupForCF=newcloudfront.KeyGroup(this,'Signing-Key-Group',{items:[pubKey]});