chmodtool.com
chmod calculator

Fix: PEM File Permissions Are Too Open (AWS EC2)

If your PEM file permissions are too open, SSH will ignore the AWS EC2 private key. Choose the item below, copy the recommended command, and retry the connection.

The AWS SSH error you are fixing

“Permissions 0644 for mykey.pem are too open”

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'mykey.pem' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "mykey.pem": bad permissions

Choose what needs to be secured

Get the correct PEM permission command

Recommended mode400
chmod 400 mykey.pem

Replace mykey.pem with the path to the key pair you downloaded from AWS. Mode 400 lets only you read the file.

  • Owner: read.
  • Group: no permissions.
  • Others: no permissions.

Live conversion

Recommended permission

Use three digits, each from 0 to 7.

Permission bits

Permission bits

Owner

The file or directory owner

Group

Members of its assigned group

Other

All other users

Why AWS recommends chmod 400 for a PEM key

The .pem file downloaded when you create an EC2 key pair is the private half of that key. Anyone who can read it can try to authenticate as you, so OpenSSH refuses to use the file while group members or other local users have access.

Mode 400 means the owner can read the key, but nobody can write to or execute it. That matches the AWS guidance for an EC2 key you download once and should not modify.

chmod 400 vs 600 for a PEM file

400Owner can read only. Use this for an AWS-downloaded PEM key.

600Owner can read and write. OpenSSH accepts it, but the extra write permission is usually unnecessary for an EC2 key.

Both modes block group and other users. If you need a broader explanation of owner-only SSH keys, see the SSH key permissions guide or inspect chmod 600 bit by bit.

Windows PowerShell

Restrict a PEM file with icacls

Windows uses NTFS access rules instead of Unix permission bits. These commands remove inherited and broad access, then leave your current account with read permission. Change the path in the first line if your key is stored elsewhere.

$key = "$env:USERPROFILE\.ssh\mykey.pem" icacls $key /inheritance:r icacls $key /remove:g "BUILTIN\Users" "NT AUTHORITY\Authenticated Users" "Everyone" icacls $key /grant:r "$env:USERNAME:(R)"

Run PowerShell as your normal Windows account. If Windows uses localized group names, remove unwanted entries through File Properties → Security instead. In WSL, keep the key inside your Linux home directory and run chmod 400 ~/mykey.pem; permissions under /mnt/c may follow Windows mount settings instead.

Permission denied (publickey)?

Check the full EC2 connection path

PEM permissions fix one local check. Work through these items in order so a key, username, or network problem is not mistaken for a chmod problem.

  1. 1

    Confirm that this is the instance's key pair

    In the EC2 console, open the instance details and compare its Key pair name with the .pem file you downloaded. A different private key cannot authenticate to the instance.

  2. 2

    Use the login name for the AMI

    Amazon Linux commonly uses ec2-user, Ubuntu uses ubuntu, and Debian may use admin. The right key with the wrong username still returns Permission denied (publickey).

  3. 3

    Restrict the PEM file to your account

    On macOS or Linux, run chmod 400 mykey.pem. On Windows, use the icacls block above. Then retry the SSH command from the same directory.

  4. 4

    Check inbound SSH access

    The instance security group must allow TCP port 22 from your current public IP. A timeout usually points to networking rather than the PEM file.

ssh -i mykey.pem ec2-user@YOUR_INSTANCE_IP

Quick answers

PEM file permissions FAQ

Should an AWS PEM file use chmod 400 or chmod 600?
AWS recommends chmod 400 for an EC2 private key: only the owner can read it, and no account can write to it. OpenSSH also accepts 600 because group and other access remain disabled. Use 400 for a downloaded key you do not need to edit; use 600 only when an owner-only process must update the file.
How do I fix PEM permissions on Windows without chmod?
Use icacls in PowerShell to remove inherited access, remove broad user groups, and grant your Windows account read permission. NTFS access rules perform the job that chmod performs on Linux and macOS.
Why does EC2 still say Permission denied (publickey)?
File permissions are only one possible cause. Confirm that the PEM file belongs to this instance, use the correct login name for the AMI, and verify that the security group allows inbound SSH on port 22 from your IP address.
What is the difference between a PEM file and a PPK file?
PEM is the private-key format commonly used by OpenSSH and the ssh command. PPK is PuTTY's native key format. Current PuTTY versions can import PEM keys, or you can convert a PEM key with PuTTYgen when an older PuTTY workflow requires PPK.

Need to verify another mode? Use the chmod calculator to convert octal and symbolic permissions.