Problem: Cannot SSH into Lightsail Instance ("Permission denied" or "Connection timed out")

Problem: Cannot SSH into Lightsail Instance ("Permission denied" or "Connection timed out")

Bash

$ ssh -i my-key.pem ubuntu@<PUBLIC_IP>
Permission denied (publickey).

# OR

$ ssh -i my-key.pem ubuntu@<PUBLIC_IP>
ssh: connect to host <PUBLIC_IP> port 22: Connection timed out

Issue:

You’re unable to SSH into your Lightsail instance. This can happen due to:

• Incorrect SSH Key – The key pair used does not match the instance.
• Port 22 Blocked – The firewall or networking rules are preventing SSH access.
• Instance Doesn't Have an SSH User Set Up – Different OS images require different default users.
• Instance is Unreachable – The instance is down, or its public IP is unassigned.

Fix: Verify SSH Key, Network Configuration, and Instance Status

Bash

# Step 1: Check if the instance is running
$ aws lightsail get-instances \
    --query "instances[].{Name:name, State:state.name, PublicIP:publicIpAddress}" \ 
    --output table

--------------------------------
|        GetInstances         |
--------------------------------
|  Name         |  State     |  PublicIP      |
--------------------------------
|  WebServer    |  Running   |  54.123.45.67  |
--------------------------------

# If the instance state is "stopped" or "stopping," restart it:
$ aws lightsail start-instance \
    --instance-name "WebServer"

# Step 2: Verify the correct key pair is being used
$ ls -l my-key.pem
-rw-------  1 user  staff  1675 Feb 10 12:00 my-key.pem

# Ensure proper permissions (should be 400)
$ chmod 400 my-key.pem

# Step 3: Confirm SSH access is allowed in Lightsail firewall
$ aws lightsail get-instance-port-states \
    --instance-name "WebServer"

{
    "portStates": [
        {
            "fromPort": 22,
            "toPort": 22,
            "protocol": "tcp",
            "state": "closed"
        }
    ]
}

# If port 22 is closed, open it:
$ aws lightsail open-instance-public-ports \
    --instance-name "WebServer" \
    --port-info fromPort=22,toPort=22,protocol=TCP

# Step 4: Use the correct default username for your OS
# Amazon Linux 2
$ ssh -i my-key.pem ec2-user@54.123.45.67

# Ubuntu/Debian
$ ssh -i my-key.pem ubuntu@54.123.45.67

# CentOS
$ ssh -i my-key.pem centos@54.123.45.67

# Step 5: If SSH still fails, check if the public IP is attached
$ aws lightsail get-instance \
    --instance-name "WebServer" \
    --query "instance.publicIpAddress" 

# Output
"54.123.45.67"

# If no public IP is assigned, create a static IP:
$ aws lightsail allocate-static-ip 
    --static-ip-name "MyStaticIP"
$ aws lightsail attach-static-ip \
    --static-ip-name "MyStaticIP" \
    --instance-name "WebServer"

Need AWS Expertise?

If you're looking for guidance on AWS Lightsail or any cloud challenges, feel free to reach out! We'd love to help you tackle your AWS projects. 🚀

Email us at: info@pacificw.com

Image: Gemini