Fix AWS EC2 SSH Errors: Permission Denied (publickey) and Connection Timed Out
Cannot SSH into your EC2 instance? Fix key permissions, use the right username, open the security group and recover access with Session Manager.
Common Symptoms and Quick Fixes
| Symptom | Likely Cause | Quick Fix |
|---|---|---|
| Permission denied (publickey) | Wrong user or wrong key | Use the AMI’s default user and the correct .pem |
| UNPROTECTED PRIVATE KEY FILE | Key file too open | chmod 400 the key |
| Connection timed out | Security group or network ACL | Allow TCP 22 from your IP |
Method 1: Fix Key Permissions
SSH refuses a private key that other users can read.
chmod 400 mykey.pem
# Windows (Command Prompt)
icacls mykey.pem /inheritance:r /grant:r "%USERNAME%:R"Method 2: Use the Correct Username
The user depends on the AMI. Amazon Linux and RHEL use ec2-user, Ubuntu uses ubuntu, and Debian uses admin. Run with -v to see why authentication fails.
ssh -i mykey.pem ec2-user@<public-ip> -vMethod 3: Open Port 22 in the Security Group
Allow SSH only from your own address.
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 22 --cidr 203.0.113.25/32Method 4: Recover When You Are Locked Out
Use EC2 Instance Connect from the console, or Session Manager if the instance has the AmazonSSMManagedInstanceCore role. From there fix ~/.ssh/authorized_keys and its permissions (700 on .ssh, 600 on authorized_keys).
Frequently Asked Questions (FAQ)
Q: Can I download the key pair again?
No. AWS only gives you the private key once. Create a new key pair and add it through Session Manager.
Q: Does a public IP change affect SSH?
Yes. Stopping and starting an instance changes the public IP unless you use an Elastic IP.