A public-private key pair supports secure SSH access to a remote computer. The private key stays on your local machine and must remain secret; the matching public key is placed on the remote server. The server verifies that you possess the private key without receiving it, authenticating your identity while keeping the session encrypted. section 12.3.6
Creating a key pair with the EB CLI
When initializing an Elastic Beanstalk application, choose SSH setup, accept or enter a key-pair name, and optionally provide a passphrase. The EB CLI generates the pair locally and uploads only the public key to EC2. AWS then checks for the corresponding private key when you connect. section 12.3.6





