This page explains how to SSH to Lightsail, AFAIK the cheapest and fastest hosting available.


What is Lightsail?

Lightsail is the cheap version of Amazon EC2.

  • Prices start at $3.50 per instance (20Gb SSD, 512Mb RAM), up to 160$/month.
  • An instance is created in seconds based on Ubuntu, Debian, FreeBSD, OpenSUSE, or Amazon Linux. There are versions with an application preinstalled, which uses images from Bitnami.
  • You can add a SSH key in the console, which will be valid for any of your instances.

Create an account

Go to and login with your Amazon credentials (or create a new account). Then create an instance:

  • I chose Linux, OS Only, Ubuntu 18.04 LTS, $3.5. The cheapest instance runs for the first month at no cost.
  • Set a random tag for your instance: janodev
  • Automatic Snapshots keep 7 days of backups at a monthly cost of less than one dollar. You can activate it later, or not use it at all.

Once you create the instance, it will be ready in ten seconds. SSH access is immediately available, but only through a web interface. You may want to add a static IP to your instance, they are free. The name of the static IP is an arbitary string.

To add a static IP click the three dots on your instance, click Manage, Networking, and click Create static IP. Attach it to the instance just created, set an arbitrary name, and click Create.

SSH access

Add your server to /etc/hosts

Add your host IP to /etc/hosts:

$ echo -e "\n35.176.128.11 awsjano" | sudo tee -a /etc/hosts

My /etc/hosts looks like this:        localhost  broadcasthost
::1              localhost    awsjano

Create a SSH key

ECDSA is not supported (I tried all three sizes 256, 384, and 521). I’m using RSA 4096 bit below.

~$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/lightsail -C ""

Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in ~/.ssh/lightsail.
Your public key has been saved in ~/.ssh/
The key fingerprint is:

The key's randomart image is:
+---[ECDSA 521]---+
|      o .=**O+.  |
|       +o=+o.o   |
|    .  .o*o+.E   |
| . o.. .o O.+    |
|. *...o.S+ + o   |
| o +.oo..   o    |
|.  o...          |
|o . o            |
| o   .           |

Set permissions so the private key is not rwx by other users.

chmod 600 ~/.ssh/lightsail

Copy your public key to the server

If you added your public key to the SSH keys of the Lightsail account before creating the instance, the key will be automatically added to authorized_keys. Once the instance is created, you can only change authorized_keys manually from the terminal.

Copy your public key

pbcopy < ~/.ssh/

SSH to your machine using the web interface (click the terminal icon), and add this key to the authorized keys.

vi ~/.ssh/authorized_keys

Note that on the bottom right you have an icon that opens the clipboard. You can paste the key there, then go to the terminal and right click with your mouse to paste.

In vi you’ll have to click $ to go to the end of the line, then a to append. If you feel lost in vi, use nano instead.

Login from your machine

Login to your Lightsail instance from your terminal using your private key, user, and server. Note that the user is ubuntu, this is a default.

ssh -i ~/.ssh/lightsail ubuntu@lightsail

To avoid specifying the key each time, I added this block to the ~/.ssh/config of my local machine.

Host lightsail
    User ubuntu
    Hostname lightsail
    PreferredAuthentications publickey
    IdentitiesOnly yes
    IdentityFile ~/.ssh/lightsail


If you use Transmit from Panic create a SFTP entry with the followind data:

  • Address: janodev
  • User Name: ubuntu
  • Password: the password you used to encrypt the key
  • Remote Path: /var/www