Open Ticket

Related Articles

View All
2 found this helpful

Updated: 18 October 2026 · Applies to: Amazon Linux 2023 (2023.12) with AWS CLI 2.36.47, tested; EC2 and IAM console steps according to AWS

The default user on Amazon Linux (Amazon Linux 2023 and Amazon Linux 2) is ec2-user. You log in with the key pair you chose when you launched the instance; there is no password, and root login is disabled:

ssh -i ~/.ssh/my-key.pem ec2-user@ec2-203-0-113-10.compute-1.amazonaws.com

ec2-user is a Linux account, not an IAM user. It decides who can log in to the server. What the AWS CLI may do in your AWS account is decided by IAM credentials (an IAM role, a console login or IAM user access keys). This article covers both.

Default user names for other AMIs

According to AWS, the default user depends on the AMI:

  • Amazon Linux, FreeBSD and Oracle Linux: ec2-user
  • Ubuntu: ubuntu
  • Debian: admin
  • Rocky Linux: rocky
  • RHEL and SUSE: ec2-user or root
  • CentOS: centos or ec2-user; Fedora: fedora or ec2-user
  • Bitnami: bitnami

For other images, ask the AMI provider. According to AWS, a wrong user name is a common cause of Permission denied (publickey), even with the right key.

How ec2-user is created

The user is created at first boot by cloud-init, so it does not exist in the Amazon Linux container image (id ec2-user said "no such user" there). The cloud-init package in Amazon Linux 2023 defines it like this (lab check, from /etc/cloud/cloud.cfg):

disable_root: true
...
   default_user:
     name: ec2-user
     lock_passwd: True
     gecos: EC2 Default User
     groups: [wheel, adm, systemd-journal]
     sudo: ["ALL=(ALL) NOPASSWD:ALL"]
     shell: /bin/bash

So ec2-user has a locked password, runs sudo without a password, and root cannot log in over SSH. AWS recommends a separate Linux user for each person instead of sharing ec2-user: sudo adduser alice, then add alice's public key to /home/alice/.ssh/authorized_keys.

Which AWS credentials to use on Linux

AWS recommends temporary credentials over long-term access keys. In practice:

  1. On an EC2 instance: an IAM role. Attach a role (instance profile) to the instance and the AWS CLI gets temporary credentials from the instance metadata. No keys are stored on the server.
  2. On your own PC or a server outside AWS: aws login (AWS CLI 2.32.0 or later), which uses your console sign-in and refreshes temporary credentials for up to 12 hours, or IAM Identity Center with aws configure sso.
  3. IAM user access keys (long-term, marked "not recommended" by AWS). Use them only when nothing else works, for example a backup script on a server outside AWS.

Configure an IAM user for the AWS CLI

Amazon Linux 2023 comes with AWS CLI version 2 (package awscli-2). On other distributions, follow how to install the AWS CLI on Linux.

  1. In the IAM console, choose Users and create the user. Under Permission options, choose Attach policies directly and attach only what the job needs (least privilege): a backup script that writes to one S3 bucket should not get AdministratorAccess. See how to give an IAM user access to one S3 folder.
  2. Open the user, select Security credentials, then Create access key. Choose Command Line Interface (CLI), and on the last step select Download .csv file. You cannot see the secret key again after you close that page.
  3. Log in to the server as the Linux user who will run the commands (not root, unless root runs them) and run aws configure. The output below uses AWS's documented example keys:
    $ aws configure

Tip: You can deliver temporary credentials to the AWS CLI using your AWS Console session by running the command 'aws login'.

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json
  4. Check what the CLI will use (this reads the local files only):
    $ aws configure list
NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : ****************MPLE     : shared-credentials-file :
secret_key : ****************EKEY     : shared-credentials-file :
region     : us-west-2                : config-file      : ~/.aws/config

Instead of typing the keys, you can import the downloaded file: aws configure import --csv file://credentials.csv. It creates a profile named after the User Name column ("Successfully imported 1 profile(s)").

Several IAM users on one Linux machine: profiles

Each set of keys becomes a named profile:

aws configure --profile deploy
aws configure list-profiles
default
deploy

The CLI keeps them in two files in the Linux user's home directory (/home/alice/.aws/, or /root/.aws/ for root). Note the different section names: [profile deploy] in config, but just [deploy] in credentials:

$ cat ~/.aws/config
[default]
region = us-west-2
output = json
[profile deploy]
region = ap-south-1
output = table
$ cat ~/.aws/credentials
[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
[deploy]
aws_access_key_id = AKIAI44QH8DHBEXAMPLE
aws_secret_access_key = je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

Both files were created with mode 600 (only the owner can read them). To use a profile:

  • Per command: aws s3 ls --profile deploy
  • For the whole shell session: export AWS_PROFILE=deploy
  • Read or change one setting: aws configure get region --profile deploy and aws configure set region eu-west-1 --profile deploy

A typo in the profile name stops the CLI with aws: [ERROR]: The config profile (nosuch) could not be found and exit code 255.

Keep the keys safe

  • Give every script or person its own IAM user or role with the smallest policy that works, rather than sharing one admin key.
  • Turn on MFA for IAM users, and delete keys you no longer use. AWS recommends replacing access keys when needed, for example when someone leaves.
  • Never copy ~/.aws/credentials into a Git repository, a backup that others can read, or a support ticket.
  • Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) take priority over the files, so check them with aws configure list when the CLI uses the wrong account.

Related: create and import an EC2 key pair with Ansible. If you would rather have engineers handle IAM, monitoring and cost control for you, see our managed AWS services.

Official documentation: Manage system users on your Amazon EC2 Linux instance, Authentication and access credentials for the AWS CLI and Configuration and credential file settings.

Was this answer helpful?

Still stuck? Open a ticket
« Back