SSH connection denied by EC2 instance - amazon-ec2

Question

I'm trying to SSH into my instance on EC2 but getting permission denied. Port 22 is open in the security group. I set 400 as a permission for the file which is setting that supposedly works in this case as I need only read. I can set 600 but in this case it's unnecessary.
Where should I take a look ? How can I fix this ?
ec2-user#35.178.89.23: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
verbose flag revealed:
debug1: Host '3.8.3.177' is known and matches the ECDSA host key.
debug1: Found key in /home/mark/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: gssapi-keyex
debug1: No valid Key exchange context
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)
debug1: Next authentication method: publickey
debug1: Offering public key: RSA SHA256:rSHi+GMCUIvsF4HA0Kv5C0++sLGGiquVQ/z/OXQBPEU mark.alexa#mail.com
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Trying private key: /home/mark/.ssh/ecs.pem
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
ec2-user#3.8.3.177: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Answer 1

AWS has a good Troubleshooting guide.
Some common causes are:
lack of inbound port 22 rule on Security Group
using the wrong SSH key (one that doesn't match the EC2 keypair)
using the wrong username (e.g. ec2-user when it should be ubuntu)
Please make sure that you are connecting with the correct private key (ssh -i key.pem ec2-user#hostname) and use the -v option to get verbose logging from ssh. This can help you determine if the request actually made it to the EC2 instance (so it's not a connectivity issue) or not (so it is a connectivity issue).
From the symptoms you've shared, I'd say that either /home/mark/.ssh/ecs.pem is not the private key associated with the keypair that you supplied when launching EC2, or you launched EC2 without a keypair.
You should be able to calculate a fingerprint of the PEM file using openssl rsa -in /home/mark/.ssh/ecs.pem -pubout -outform DER | openssl md5 -c and compare that to the fingerprint shown in the EC2 keypair console. If they don't match, you are using the wrong private key.