The username depends on the operating system and AMI you chose
When you launch an Amazon EC2 instance, the default username is not "admin" or "root" — it varies by the image you selected. AWS does not assign you a custom username; instead, each pre-built image (called an AMI, or Amazon Machine Image) comes with a built-in account. The username you need is baked into that image, and you find it by knowing which image you launched.
The most common usernames are ec2-user (for Amazon Linux and Amazon Linux 2), ubuntu (for Ubuntu images), admin (for Debian), and ec2-user again (for some Red Hat images). Windows instances work differently — they use a local Administrator account, and you retrieve a password instead of a username.
You do not need to guess. AWS stores the image information in your instance details, and you can look it up in seconds.
Key Takeaways
- The default username is determined by the AMI (image) you selected when launching the instance, not by AWS or your account settings.
- Amazon Linux instances use ec2-user, Ubuntu instances use ubuntu, and Debian instances use admin as the default username.
- You can find which AMI you used by opening the EC2 console, selecting your instance, and checking the "Details" tab under "Image ID".
- Once you know the AMI type, you can connect via SSH using that username and your private key file, with no password required.
How to find which AMI your instance is running
Open the AWS Management Console and navigate to EC2. In the left sidebar, click Instances. Find your instance in the list and click on it to open the details panel on the right side of the screen.
Look for the Image ID field in the Details tab. It will show something like "ami-0c55b159cbfafe1f0". Below or near that field, you should also see the Image name or a description of the image — for example, "amzn2-ami-hvm-2.0.20231218.0-x86_64-gp2" or "ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20231218". This name tells you the operating system and base image.
If the Image name field is blank, copy the Image ID and search for it in the AMI section of the EC2 console. Click Images in the left sidebar, then AMIs, and paste the ID into the search box. The result will show you the full image name and operating system.
Match the image name to the default username
Once you know the image name, use this table to find the correct username:
| Image Type | Default Username | Example Image Name |
|---|---|---|
| Amazon Linux 2 | ec2-user | amzn2-ami-hvm-2.0.x |
| Amazon Linux (original) | ec2-user | amzn-ami-hvm-x |
| Ubuntu | ubuntu | ubuntu/images/hvm-ssd/ubuntu-focal-20.04 |
| Debian | admin | debian-12-amd64 |
| Red Hat Enterprise Linux | ec2-user | RHEL-9.x |
| CentOS | centos | CentOS-7-x86_64 |
| Windows | Administrator | Windows_Server-2022-English-Core |
If your image name does not match any of these, search the AWS documentation for that specific AMI. The vendor or AWS always publishes the default username in the image details or launch instructions.
How to connect using SSH with your username
Once you know the username, you can connect to your instance from your local computer. Open a terminal (or Command Prompt on Windows) and run this command:
ssh -i /path/to/your/private-key.pem ec2-user@your-instance-public-ip
Replace /path/to/your/private-key.pem with the actual path to your private key file (the .pem file you downloaded when you created the key pair). Replace ec2-user with the correct username for your image. Replace your-instance-public-ip with the public IP address of your instance, which you can find in the Details tab of the EC2 console.
If you see a "Permission denied (publickey)" error, the most common causes are a wrong username, a wrong path to the private key, or the instance's security group not allowing SSH traffic on port 22. Check all three before troubleshooting further.
What to do if you cannot find the image name
If the image has been deleted or is no longer available in your account, you can still find the username by checking the instance's user data or by looking at the instance metadata. In the EC2 console, select your instance and scroll down to the User data section. If a script was run at launch, it may contain clues about the operating system.
Another approach is to use the Systems Manager Session Manager to connect without SSH. In the AWS console, go to Systems Manager, then Session Manager, and click Start session. Select your instance and click Connect. This opens a shell without requiring you to know the username in advance. Once connected, you can run whoami to see the current user, or cat /etc/os-release to confirm the operating system.
Windows instances use a password, not a username
If you launched a Windows instance, the default username is Administrator, but you do not use it with SSH. Instead, AWS generates a random password that you retrieve from the console. Select your instance in the EC2 console, click Connect, and choose the RDP client tab. Click Get password, select your private key file, and AWS will decrypt and display the Administrator password.
Use that password to connect via Remote Desktop Protocol (RDP) on Windows, or a third-party RDP client on Mac or Linux. The username is always Administrator for standard Windows images.
Frequently Asked Questions
Can I change the default username after the instance is running?
Yes, but it requires connecting first with the default username and then creating a new user account or modifying the existing one. For most use cases, it is simpler to keep the default username. If you need a custom username for your team, create a new user account after you connect, rather than renaming the default one.
What if I lost my private key file?
If the instance is running, you cannot recover the original key. Your options are to use Systems Manager Session Manager (if the instance has the correct IAM role), to stop the instance and attach its volume to another instance, or to terminate it and launch a new one with a new key pair. Plan ahead by storing private keys securely.
Why does SSH say "permission denied" even though I have the right username and key?
The most common cause is that the instance's security group does not allow inbound SSH traffic on port 22. Check the security group rules in the EC2 console. You should see an inbound rule that allows SSH (port 22) from your IP address or from 0.0.0.0/0. If it is missing, add it. Also confirm that your private key file has the correct permissions (chmod 400 on Mac or Linux).
Do I need a password if I have the private key?
No. SSH with a private key does not require a password. If you are prompted for a password, it usually means the key is not being found or recognized. Double-check the path to the key file and make sure you are using the correct username for your image.