Import Key Pair documentation - b64 requirement reversed

[nickchap]

Describe the issue

The import key pair boto3 documentation does not correctly describe when the key must be base64-encoded. It's the reverse of what's listed. The upstream API documentation is also wrong, I'll submit a feedback to that as well.

The page states:

PublicKeyMaterial (bytes) –

[REQUIRED]

The public key. For API calls, the text must be base64-encoded. For command line tools, base64 encoding is performed for you.

However, actually the aws cli requires the key to be base64 encoded and boto3 requires it not be base64 encoded.

Attempting to enter a base64 encoded key via cli gives an error:

aws ec2 import-key-pair --key-name mykey --public-key-material file://key.pub

Invalid base64: "ssh-ed25519 xxxxxxxxxxxx [email protected]
"

This works:

aws ec2 import-key-pair --key-name mykey --public-key-material `cat key.pub | base64`

Likewise, using boto3 to import a b64 encoded key ( client.import_key_pair(KeyName=default_key_name, PublicKeyMaterial=b64pub_key) ) gives this error:

botocore.exceptions.ClientError: An error occurred (InvalidKey.Format) when calling the ImportKeyPair operation: Key is not in valid OpenSSH public key format

But passing in the non-b64 encoded public key works fine.

Links

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ec2/client/import_key_pair.html

[adev-code]

Hi @nickchap, thanks for reaching out. I have noticed from your command that you are using "file://key.pub/". You can try "fileb://" for using CLI V2 or you can revert to the v1 behavior with the configuration: cli_binary_format=raw-in-base64-out (aws/aws-cli#4969 (comment)). This "fileb://" can be seen also from the current documentation: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/import-key-pair.html#examples. Please let me know if you have any other questions. Thank you.