How do I replace a lost key pair for my EC2 Windows instance?

Last updated: 2019-08-27

I lost the private key file for the key pair that is used to launch my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance. How can I replace or change the key pair on an EC2 Windows instance? 


To change the key pair, create an AMI of the existing instance, and then launch a new instance. You can then select a new key pair by following the instance launch wizard. Follow these steps:

  1. Create a new key pair and save the private key file. You can create a key pair using the console, AWS Command Line Interface (AWS CLI), or AWS Tools for Windows PowerShell. For more information, see Creating a Key Pair Using Amazon EC2.
    Note: To give the new key pair the same name as the lost key pair, you must first delete the lost key pair.
  2. From the Amazon EC2 console, choose Instances from the navigation pane.
  3. Select your instance. From the Description tab, take note of the Instance type, VPC ID, Subnet ID, Security groups, and IAM role for the instance.
  4. Warning: If this instance has an instance store volume, any data on it is lost when the instance is stopped. If the instance shutdown behavior is set to Terminate, the instance terminates when it is stopped. Stop your instance.
  5. Select your instance. For Actions, choose Image, Create Image. For Image name, enter a name.
    (Optional) For Image description, enter a description.
  6. Choose Create Image, and then choose Close.
  7. Choose AMIs from the navigation pane. If the Status is pending, the AMI is still being created. When the Status is available, continue to the next step.
  8. Select the AMI, and then choose Launch.
  9. Complete the wizard. Be sure to select the same Instance type, VPC ID, Subnet ID, Security groups, and IAM role as the instance that you are replacing.
    For Select a key pair, choose the new key pair.
  10. (Optional) If the original instance has an associated Elastic IP address, reassociate the Elastic IP address to the new instance.
  11. (Optional) If any EBS volumes aren't captured during the AMI creation, detach the volume, and then attach the volume to the new instance.
    Note: When you detach the volume, you can skip the step to unmount the volume, because the original instance is already in stopped state.
  12. Terminate the stopped instance.