{"record":{"id":"7167b627fafffb4a","repo":"oven-sh/bun","slug":"failed-to-import-key-pair-keyname","errorCode":null,"errorMessage":"Failed to import key pair: ${keyName}","messagePattern":"Failed to import key pair: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"scripts/machine.mjs","lineNumber":327,"sourceCode":"\n    /** @type {AwsKeyPair | undefined} */\n    const keyPair = await aws.spawn(\n      $`ec2 import-key-pair --key-name ${keyName} --public-key-material ${publicKeyBase64}`,\n      {\n        throwOnError: error => !/InvalidKeyPair\\.Duplicate/i.test(inspect(error)),\n      },\n    );\n\n    if (keyPair) {\n      return keyPair;\n    }\n\n    const keyPairs = await aws.describeKeyPairs(keyName);\n    if (keyPairs.length) {\n      return keyPairs[0];\n    }\n\n    throw new Error(`Failed to import key pair: ${keyName}`);\n  },\n\n  /**\n   * @param {AwsImage | string} imageOrImageId\n   * @returns {Promise<AwsImage>}\n   */\n  async getAvailableImage(imageOrImageId) {\n    let imageId = imageOrImageId;\n    if (typeof imageOrImageId === \"object\") {\n      const { ImageId, State } = imageOrImageId;\n      if (State === \"available\") {\n        return imageOrImageId;\n      }\n      imageId = ImageId;\n    }\n\n    await aws.waitImage(\"image-available\", imageId);\n    const [availableImage] = await aws.describeImages({","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/scripts/machine.mjs#L309-L345","documentation":"importKeyPair() first tries `ec2 import-key-pair`; if that yields nothing it falls back to describeKeyPairs for the name; the error fires only when the import failed AND no key pair with that name already exists — so the import itself errored (bad key material, permissions, region) rather than merely being a duplicate.","triggerScenarios":"Malformed/unreadable public key material passed to import-key-pair; IAM principal lacking ec2:ImportKeyPair or ec2:DescribeKeyPairs; importing into a different region than the one later described; AWS eventual-consistency lag right after import.","commonSituations":"CI role permissions narrowed during an IAM cleanup; key file generation step silently failed before this call; region mismatch between import and describe.","solutions":["Run `aws ec2 describe-key-pairs --key-names <keyName> --region <region>` to confirm absence","Re-run the import manually with the same PublicKeyMaterial to surface the real error","Grant ec2:ImportKeyPair/ec2:DescribeKeyPairs to the CI role","Retry once after a few seconds in case of eventual consistency"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Confirm the key is really absent before treating import failure as fatal\nconst existing = await aws.describeKeyPairs(keyName);\nif (!existing.length && !publicKeyMaterial) {\n  throw new Error(`cannot import key pair ${keyName}: no key material provided`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await aws.importKeyPair(keyName, material);\n} catch (error) {\n  // Distinguish 'already exists' (fine — describe and reuse) from real failures\n  const found = await aws.describeKeyPairs(keyName);\n  if (found.length) return found[0];\n  throw error;\n}","preventionTips":["Pin the region on every key-pair call — imports are region-scoped","Grant the CI role ec2:ImportKeyPair + ec2:DescribeKeyPairs explicitly","Validate key material is a valid OpenSSH public key before importing"],"tags":["aws","ec2","ssh","key-pair"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}