How to properly get the password in plaintext format of a windows ec2 instance which is created using the machine's KeyPair(all types rsa, openssh) using AWS Python Boto (old boto not new boto3) SDK.

Hi Prem,

Please try the below steps i hope it will helps solve your issue.

Fetch the Encrypted Password Data:

• Use the Boto library to fetch the encrypted password data of the Windows EC2 instance.
• Use the following function to fetch the encrypted password data using the Boto library:

import boto
from boto.ec2.connection import EC2Connection

def get_encrypted_password(instance_id, region):
    conn = EC2Connection(region=region)
    encrypted_password = conn.get_password_data(instance_id)
    return encrypted_password

Decrypt the Password:

• Decrypt the password using the appropriate private key (OpenSSH format or RSA Private Key).
• To decrypt the password, you can use the M2Crypto library, which supports various key formats.

First, install M2Crypto:

pip install M2Crypto

Then, use the following function to decrypt the password:

from M2Crypto import RSA, BIO

def decrypt_password(encrypted_password, private_key_path):
    # Load the private key
    with open(private_key_path, 'rb') as key_file:
        private_key = RSA.load_key_bio(BIO.MemoryBuffer(key_file.read()))
    
    # Decrypt the password
    decrypted_password = private_key.private_decrypt(
        encrypted_password.decode('base64'),
        RSA.pkcs1_padding
    )
    return decrypted_password

Putting It All Together

Here is the complete script combining the two functions:

import boto
from boto.ec2.connection import EC2Connection
from M2Crypto import RSA, BIO

def get_encrypted_password(instance_id, region):
    conn = EC2Connection(region=region)
    encrypted_password = conn.get_password_data(instance_id)
    return encrypted_password

def decrypt_password(encrypted_password, private_key_path):
    with open(private_key_path, 'rb') as key_file:
        private_key = RSA.load_key_bio(BIO.MemoryBuffer(key_file.read()))
    decrypted_password = private_key.private_decrypt(
        encrypted_password.decode('base64'),
        RSA.pkcs1_padding
    )
    return decrypted_password

def main(instance_id, region, private_key_path):
    encrypted_password = get_encrypted_password(instance_id, region)
    decrypted_password = decrypt_password(encrypted_password, private_key_path)
    print(f'Decrypted password: {decrypted_password}')

if __name__ == '__main__':
    instance_id = 'i-xxxxxxxxxxxxxx'  # Replace with your instance ID
    region = 'us-west-2'  # Replace with your region
    private_key_path = '/path/to/your/private/key.pem'  # Replace with the path to your private key
    main(instance_id, region, private_key_path)

• Ensure that you have the appropriate permissions to fetch the password data of the instance.
• The private key should be in the format supported by M2Crypto. If you have a different format (like OpenSSH), you might need to convert it to a format compatible with M2Crypto (like PEM).