When a Windows instance is created in AWS, its password is encrypted using the public part of an SSH key.
It's then possible to use the following command to retrieve the encrypted password:
aws ec2 get-password-data --instance-id=i-0a5102eb55ed6e0b9
(See https://docs.aws.amazon.com/cli/latest/reference/ec2/get-password-data.html#examples)
The command returns the following data:
{
"InstanceId": "i-0a5102eb55ed6e0b9",
"Timestamp": "2019-11-04T12:21:30.000Z",
"PasswordData": "\r\nbase64_data==\r\n"
}
The encrypted password data is base64 encoded, but it's possible to decrypt the "PasswordData" field if you have the private part of the SSH key:
echo "base64_data" | base64 --decode | openssl rsautl -decrypt -inkey "./path_to_private_ssh_key"
(See Github repo example at https://github.com/tomrittervg/decrypt-windows-ec2-passwd/blob/master/decrypt-windows-ec2-passwd.sh)
This works fine, however, I use a Nitrokey Professional to store my private key and I can't see a way to tell the openssl command to use the GPG card to decrypt the data. I'd like to keep private keys off my disk if possible.
For reference, to get the public key into AWS, I exported the public key in the correct SSH format for AWS using the gpg --export-ssh-key nameofuser@example.com
command.
Is there a way to decrypt the data using the card?