enumerate_ec2_passwords.py

import boto3
import base64
import argparse

# Parse command-line arguments
parser = argparse.ArgumentParser(description="List EC2 instances and their passwords.")
parser.add_argument("--profile", required=True, help="AWS profile to use")
args = parser.parse_args()

# Use specified AWS profile
session = boto3.Session(profile_name=args.profile)
ec2 = session.client("ec2")

# Get list of EC2 instances
response = ec2.describe_instances()
instances = [
    i["InstanceId"]
    for r in response["Reservations"]
    for i in r["Instances"]
]

for instance_id in instances:
    # Get encrypted password data
    password_data_response = ec2.get_password_data(InstanceId=instance_id)
    encrypted_password = password_data_response["PasswordData"]

    if not encrypted_password:
        print(f"[{instance_id}] No password data available.")
        continue

    # Decode password (if not encrypted)
    try:
        print(f"[{instance_id}] Encrypted Password: {encrypted_password}")
    except Exception as e:
        print(f"[{instance_id}] Could not decode password: {e}")