title: Enable SSH with a password instead of pem key
body: <p>I am launching an EC2 instance using cloudformation. I want to enable SSH with a password instead of pem key for that instance. I am able to write the startup script (user data) to do this, but I have set the static password 'pass123' for user 'student'. I want to make this dynamic (random).
  We would be happy with anything, really, other than SSH client certificate authentication.</p>
  
  <p>Here is my cloudformation template:</p>
  
  <pre><code>{
     "AWSTemplateFormatVersion":"2010-09-09",
     "Description":"Password for instance",
     "Parameters":{
        "KeyName":{
           "Description":"Name of an existing EC2 KeyPair",
           "Type":"String"
        },
        "AWSAmiId":{
           "Description":"AMI Id to find",
           "Type":"String",
           "Default":"x86_64,amzn-ami-pv-2014.09.1.x86_64-ebs,amazon,ebs,paravirtual"
        }
     },
     "Resources":{
        "Ec2Instance":{
           "Type":"AWS::EC2::Instance",
           "DependsOn":"Ec2SecurityGroup",
           "Properties":{
              "ImageId":{
                 "Ref":"AWSAmiId"
              },
              "InstanceType":"t1.micro",
              "Tags":[
                 {
                    "Key":"Name",
                    "Value":"MYINSTANCE"
                 }
              ],
              "DisableApiTermination":"true",
              "SecurityGroupIds":[
                 {
                    "Ref":"Ec2SecurityGroup"
                 }
              ],
              "KeyName":{
                 "Ref":"KeyName"
              },
              "UserData":{
                 "Fn::Base64":{
                    "Fn::Join":[
                       "\n",
                       [
                          "#!",
                          "useradd student\n",
                          "echo pass123 | passwd student --stdin\n",
                          "echo \"student ALL=(ALL) NOPASSWD: ALL\" | tee -a /etc/sudoers\n",
                          "mkdir /home/student/.ssh\n",
                          "cp cp ~ec2-user/.ssh/authorized_keys ~student/.ssh/authorized_keys\n",
                          "sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config\n",
                          "service sshd reload\n"
                       ]
                    ]
                 }
              }
           }
        },
        "Ec2SecurityGroup":{
           "Type":"AWS::EC2::SecurityGroup",
           "Properties":{
              "GroupDescription":"VPC Security Group",
              "SecurityGroupIngress":[
                 {
                    "CidrIp":"0.0.0.0/0",
                    "FromPort":"22",
                    "IpProtocol":"tcp",
                    "ToPort":"22"
                 }
              ]
           }
        }
     },
     "Outputs":{
        "Password":{
           "Description":"newly created EC2 instance",
           "Value":"pass123"
        }
     }
  }
  </code></pre>
  
  <p>Password could be:</p>
  
  <ul>
  <li><p>The filename of the SSH key</p></li>
  <li><p>The AMZN account ID (eg: 45678923)</p></li>
  <li><p>A random string (poiblkjfda)</p></li>
  </ul>