What chmod 400 grants
The first digit is 4, granting read permission to the owner. The group and other-user digits are 0, and no write or execute bits are present. A regular file appears as -r--------. Its owner can open the file, while ordinary processes cannot modify or execute it and other local users receive no access.
Mode 400 is a guard against routine writes, not an immutable lock. The file owner can change the mode again, and privileged accounts may still alter the file. Use it to express that normal operation is read-only; use filesystem immutability, protected deployment controls, or a secret manager when stronger change protection is required.
Read-only keys and credentials
Authentication clients generally need to read a private key but do not need to rewrite it. Removing owner write permission reduces the chance that a script, editor, or mistaken redirect overwrites the only local copy. The same pattern can fit exported credentials or signed material that an application consumes without updating.
A read-only mode does not replace backups or key rotation. Before restricting the working copy, store recovery material according to the provider guidance and verify that the application truly reads rather than updates the file. A program that legitimately rewrites a credential needs an owner-writable mode or a separate managed storage workflow.
Why AWS tutorials use chmod 400 for PEM files
An EC2 key-pair download is used as an SSH private key. The SSH client needs to read it, but editing the downloaded key is not part of connecting to an instance. Mode 400 therefore supplies the required read access while denying both local disclosure to other users and unnecessary owner writes.
If the SSH client reports an unprotected private key or ignores the PEM file, the problem is a task-specific connection error rather than a request for a permission definition. Use the AWS PEM permissions fix for macOS, Linux, Windows, WSL, username, key-pair, and security-group checks.
400 compared with 600
chmod 600 adds owner write permission while keeping group and other users blocked. Choose 600 for a private file that its owner must edit, such as an actively maintained credential file. Choose 400 for a consumed key or secret that should remain read-only during ordinary use.
Both modes depend on correct ownership. If the wrong account owns a 400 file, the intended process cannot read it, and broadening the group or other digits is rarely the right repair. Confirm the owner and the account running the command before granting additional access.