Can I remove the default SSH key of an Elastic Beanstalk instance?

Question

I'm looking to lock down security on my AWS Elastic Beanstalk instances. I actually manage my beanstalk instances with Chef, and I use that to deploy individual developer SSH keys to the instances.

I no longer need the key that beanstalk put on the server. Can I safely remove it from the authorized keys file? I can't find any documentation from Amazon about whether this will interfere with deployments or changing out Environment Properties.

Answer 1

If you configured your EC2 key pair using the EC2KeyName Elastic Beanstalk configuration option, you can remove it using the AWS CLI:

aws elasticbeanstalk update-environment --environment-name $ENV \
    --options-to-remove 'Namespace=aws:autoscaling:launchconfiguration,OptionName=EC2KeyName'