ec2.KeyPair how to label a generated Private Key?

[Cameronsplaze]

In the console, you can use the EC2 KeyPairs screen to find the ID and look up the private key in the Parameter store. How do you go the other direction? On the private key Parameter Store screen, how do you find which KeyPair / Stack it belongs to? I'm trying to add tags and/or a description to the SSM parameter key.

I deploy multiple of the same stack, and it's a pain to cross reference the list, instead of being able to populate the Description / Tags of the private key with this info (Or best yet, being able to give the private key a custom name that contains the stack it's deployed with. I'm guessing this is much harder though...)

Generate a Key Pair:

# https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.KeyPair.html
self.ssh_key_pair = ec2.KeyPair(
    self,
    "ssh-key-pair",
    key_pair_name=f"{construct_id}-key-pair",
)

# Get the Private Key:
# https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.IStringParameter.html
self.private_key = self.ssh_key_pair.private_key

Some idea's I've tried:

# These won't show up in the console for some reason (or ANY tags added to private_key)
Tags.of(self.private_key).add("ssh_key_pair_id", self.ssh_key_pair.key_pair_id)
Tags.of(self.private_key).add("Stack", construct_id)

I just learned about escape hatches, to try to override the Description to include the stack name:
https://docs.aws.amazon.com/cdk/v2/guide/cfn_layer.html#develop-customize-override

cfn_private_key = self.private_key.node.default_child
cfn_private_key.add_property_override("Description", f"Private key for {construct_id}")

But that gives AttributeError: 'NoneType' object has no attribute 'add_property_override'.

Printing the private key to the console gives <jsii._reference_map.InterfaceDynamicProxy object at 0x7f8bf477dbb0>, and not the normal CDK import class I'm used to, maybe that's a hint?

[Cameronsplaze]

I think one of the things biting me is the private_key returned is a IStringParameter instead of a StringParameter, and thus doesn't have a Description field.

If cdk creating extra objects behind the scenes is anything like "importing" objects, they can't be edited either. It looks like IStringParameter is from the different StringParameter "import" methods, so I wonder if that's what's going on.

---

Since ec2.KeyPair can accept a public key, another path is to generate one the same way as CDK does, and pass it into the ec2.KeyPair(public_key_material=...) myself. Then I could tag the original ssm param and give it a description, since I created it. I can't find how to generate the keys through CDK. (If I do something like system calls, they'll change every time you deploy, and it feels VERY hacky/prone-to-errors). If there's a cdk object I'm missing that generates ssh keys, this definitely feels like the cleanest solution so far though.