Copy and save the value for future use.

2. Execute the command to the fleet of instances to rotate the PEM key
In your AWS Console, go to AWS Systems Manager Fleet Manager and choose the instance you want to rotate. For this example, let’s start with Ubuntu Instance.

Click Node actions > Execute run command

This will open the AWS Systems Manager – Run Command on a new tab.

Filter AWS-RunShellScript then select.

Scroll down until you find Command parameters

Paste the following command and replace the public key value with the generated from step 1 and the instance username.

(new.pem.pub):

sudo su
echo "<replace with public key value>" > /home/<replace with instance username>/.ssh/authorized_keys

For this example, the username is ubuntu
sudo su
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDduEnWhAuZFZ3jzPvmINzwvWwwmM3rX0dblLh1PnUQHBJwPZ/q09iiOrhussQyVnJp

+Gi6lnE4JGARhauZ13cxYZ4y2dp9tlGvdG+lAgAJJx/j6nXGbkYahUWsP5OURU1NZRUfefajE+PBihIHtb/eYaAGvPkLPgwI

YFONtoVRkuNYH79JTsWKWKrQCnvOuE9ITYcg4EddR6VRhNhEGtR6j5M1lA8t/VzulzA3wT01ecOOAgqjZEWsZequo73gao2g

4J/Ep1Aa7QWaY/DXuUH6JpZeBHyvASKtpuSs+N99Xo9UZcQ5YqkWjJgOQMQlFKl2hzG8/WzSINULxnYZYwN/" >

/home/ubuntu/.ssh/authorized_keys

Scroll down and under Target selection, make sure the correct instance to be rotated is selected.

Since this is a simple command, uncheck Enable an S3 bucket

Scroll down and click Run

This will run the rotate command to the Ubuntu instance. Click the refresh button until it’s finished.

3. Test if the PEM key rotation is successful
Let’s test first if the old PEM key will still connect to the Ubuntu instance.

As expected, the old PEM key has been revoked from accessing the Ubuntu instance.

Now let’s test SSH using the new PEM key.

Congratulations! We have successfully accessed the Ubuntu instance using the new PEM key.

With a few simple steps, we have completed the whole PEM key rotation process. By leveraging AWS Systems Manager, we can easily rotate the PEM key of the other instances in batches using the same process.

Note: the selected instances share the same public key (new.pem.pub) and user name (ec2-user), therefore, we can use the same command.

Assuming all the PEM key of the fleet of instances has been rotated, the resigned DevOps Engineer will now be prevented from remotely accessing the company servers, eliminating the security vulnerability. This type of scenario is some of the examples that you can find from the AWS Certified Solutions Architect – Professional (SAP-C02) certification exam.

Aside from automatically rotating the PEM keys of your server fleet, the AWS Systems Manager Fleet Manager can also be used to access the Red Hat Knowledgebase Portal, manage node status, view instance information, manage accounts and registry as well as view the edge device information.