KeePass

Prerequisites

Before you launch the KeePass AMI, make sure the following are in place.

AWS account. You need an active AWS account with permissions to launch EC2 instances, manage security groups and access the AWS Marketplace.

EC2 key pair. Create a key pair, or identify an existing one, in the region where you plan to launch the instance. You need this key pair to decrypt the Windows Administrator password after launch.

Security group. Prepare a security group that allows inbound RDP access. The required rule is shown below.

Protocol Type Port Description

RDP TCP 3389 Remote Desktop Access

Restrict the source IP range for RDP access to your known IP addresses or corporate CIDR blocks instead of allowing access from 0.0.0.0/0. This is especially important for an instance that stores password databases.

Remote Desktop client. Install a Remote Desktop Protocol client on your local machine. Options include Microsoft Remote Desktop (available for Windows and macOS), Remmina (Linux) and any other RDP-compatible client.

Minimum Instance Requirements

Minimum CPU Minimum RAM Required Disk Space

1 vCPU 1 GB 30 GB

A t3.micro or t3.small instance type is sufficient for KeePass, a lightweight desktop application that does not need significant compute resources.

Step-by-step setup

Follow these steps to launch and connect to your KeePass instance.

Step 1 - Launch the instance

• Sign in to your AWS account and open the AWS Marketplace.
• Search for the SecureAnyCloud KeePass AMI.
• Select your instance type (t3.small is recommended).
• Choose your region and VPC configuration.
• Select the EC2 key pair you created in the prerequisites.
• Assign the security group that allows RDP on port 3389.
• Configure storage with at least 30 GB on the root volume.
• Launch the instance.

Step 2 - Wait for the status checks

After you launch the instance, open the EC2 console and wait until the instance shows 2/2 status checks passing. This confirms that the instance has fully booted and Windows has completed its initial setup. The process typically takes between 3 and 10 minutes.

Step 3 - Retrieve the Administrator password

• Open the EC2 console in the AWS region where you launched the instance.
• Select Instances in the left navigation panel.
• Select your newly launched instance.
• Choose Actions at the top of the page.
• Choose Security, then select Get Windows password.
• Choose Browse and upload the private key file (.pem) from the key pair you selected during launch.
• Choose Decrypt password.
• Copy the decrypted password and store it securely. This is your Administrator password.

Step 4 - Connect with Remote Desktop

• Open your Remote Desktop client.
• Create a new connection to the public IP address of your EC2 instance. If you connect through a VPN or from within the same VPC, use the private IP address instead.
• Enter the following credentials when prompted:
• Username: Administrator
• Password: The decrypted value from Step 3
• If a certificate warning appears, select Continue. This warning is expected for new connections.
• Wait for the Windows Server desktop to appear.

Step 5 - Launch KeePass

On the desktop, find the KeePass 2 shortcut icon and double-click it to launch the application. KeePass is preinstalled and ready to use immediately.

Server Components

This AMI includes the following preinstalled software.

Component Version

KeePass 2 Latest

The AMI is built on Windows Server and includes the base operating system with KeePass 2 preinstalled and configured. KeePass 2 is the .NET-based version of KeePass. It offers plugin support, auto type and advanced encryption options.

Filesystem Layout

The instance uses a single volume.

Drive Purpose Minimum Size

C:\ Operating system and application 30 GB

Key directories on the instance:

Path Description

C:\Program Files (x86)\KeePass Password Safe 2\ KeePass installation directory

C:\Users\Administrator\Desktop\ Desktop with KeePass shortcut

C:\Users\Administrator\Documents\ Recommended location for database files

C:\Users\Administrator\AppData\Roaming\KeePass\ User configuration and plugin directory

KeePass database files (.kdbx) are very small, typically under 1 MB even with hundreds of entries. The 30 GB volume leaves ample space for the operating system, the application and your password databases.

Managing the Application

Create a new password database

• Launch KeePass from the desktop shortcut.
• Choose File, then New.
• Choose a location for your database file. The Documents folder is recommended.
• Enter a name for your database file, for example MyPasswords.kdbx.
• Set a strong master password. KeePass asks for it every time you open the database.
• Optionally, create a key file for additional security. A key file adds a second authentication factor that must be present alongside the master password.
• Select OK to create the database.

Add password entries

• Open your password database and unlock it with your master password.
• Right-click in the entries area and select Add Entry, or press Ctrl+I.
• Fill in the title, username, password and URL fields.
• Select the Generate a password button (the key icon) to create a strong, random password.
• Add any notes or additional fields you need.
• Select OK to save the entry.
• Save the database with Ctrl+S, or choose File, then Save.

Organize entries into groups

KeePass organizes password entries into hierarchical groups:

• Right-click the root group or any existing group in the left panel.
• Select Add Group to create a new category.
• Name the group, for example Web Logins, Servers or Email Accounts.
• Drag and drop entries between groups.

Use the password generator

KeePass includes a built-in password generator:

• Choose Tools, then Generate Password from the menu bar.
• Configure the character set, length and pattern for generated passwords.
• Include uppercase letters, lowercase letters, digits, special characters and more, as needed.
• Select Generate to create passwords, then copy them to the clipboard.

Search for entries

Use the search bar at the top of the KeePass window to find entries across all groups. You can search by title, username, URL, notes or any other field.

Use auto type

KeePass can type usernames and passwords into application windows for you:

• Open the target application or website login page.
• Switch to KeePass and select the relevant entry.
• Press Ctrl+V, or right-click and select Perform Auto Type.
• KeePass switches to the target window and types the credentials automatically.

Copy credentials to the clipboard

Double-click the username or password column in an entry to copy it to the clipboard. By default, KeePass clears the clipboard after 12 seconds for security.

Import entries from other password managers

KeePass can import password databases from many other formats:

• Choose File, then Import.
• Select the source format (CSV, XML, 1Password, LastPass and many others).
• Browse to the export file from your previous password manager.
• Review the imported entries and save the database.

Scripts and Logs

KeePass configuration files

KeePass stores its configuration files in these locations:

File Location Description

C:\Program Files (x86)\KeePass Password Safe 2\KeePass.config.xml Global configuration

C:\Users\Administrator\AppData\Roaming\KeePass\KeePass.config.xml User specific configuration

Database backup files

KeePass can create automatic backups of your database. To enable this feature, choose Tools, then Options, then Advanced, and configure the backup settings.

Windows Event Logs

For system-level diagnostics, use the Windows Event Viewer. Press the Windows key, search for Event Viewer and open it to review application and system logs.

Troubleshooting

You cannot connect over RDP

• Verify that the instance has passed 2/2 status checks in the EC2 console.
• Confirm that your security group allows inbound TCP traffic on port 3389 from your IP address.
• Confirm that you are using the correct public IP address. If you stopped and started the instance, the public IP address may have changed unless you use an Elastic IP.
• Check that your local firewall or corporate network does not block outbound RDP connections.

Password decryption fails

• Make sure you upload the .pem file that matches the key pair you selected at launch.
• The password can take up to 15 minutes to become available after the first launch. If the option is greyed out, wait and try again.

You cannot open the KeePass database

• Verify that you are entering the correct master password. KeePass master passwords are case-sensitive.
• If you configured a key file, make sure it is accessible at the expected location.
• Check whether the .kdbx file is corrupted. If you have a backup copy, try opening that instead.

KeePass does not open or crashes

• Launch KeePass again from the desktop shortcut.
• Check the Windows Event Viewer for application errors.
• Verify that the C: drive has sufficient free space.
• Make sure the .NET Framework is installed and working correctly. It is preinstalled on this AMI.

You forgot the master password

• KeePass encryption is designed to be unbreakable without the master password, and the application has no built-in recovery mechanism.
• If you used a key file, you still need the master password to open the database.
• For this reason, store your master password in a separate, secure location and keep regular backups.

Auto type does not work correctly

• Make sure the target window title matches the entry's URL or title field in KeePass.
• Some applications need custom auto type sequences. Edit the entry and configure the sequence on the Auto Type tab.
• If characters are missed, increase the auto type delay in the KeePass options.

The RDP session disconnects frequently

• Check the stability of your network connection.
• Lower the display quality or disable visual effects in the RDP client settings to reduce bandwidth requirements.
• Make sure the instance is not running out of memory, which can make Windows unresponsive.

Security Recommendations

Change the Administrator password

After your first sign-in, replace the default Administrator password with a strong, unique password. Open the Windows command prompt or PowerShell and run:

net user Administrator YourNewStrongPassword

Once you change the password, the original decrypted password from the AWS console is no longer valid.

Restrict RDP access

Limit the security group rule for port 3389 to your specific IP addresses or a trusted CIDR range. An instance that hosts a password database needs the strictest possible network access controls. Never use 0.0.0.0/0 for a KeePass instance.

Use a strong master password

Choose a master password that is long (20 characters or more), unique and not used anywhere else. A passphrase made of several random words is both strong and easy to remember.

Use a key file for two-factor protection

Configure KeePass to require both a master password and a key file to open the database. Store the key file separately from the database, for example on an encrypted USB drive or in a separate S3 bucket. Even if someone gains access to the instance, they cannot open the database without the key file.

Enable volume encryption

Use EBS encryption on the instance volume to protect the password database at rest. When you create a new instance, select an encrypted volume at launch. For an existing volume, create an encrypted snapshot and restore from it.

Back up the database regularly

• Copy the .kdbx database file to Amazon S3 regularly, using the AWS CLI or a file transfer tool. Use server-side encryption on the S3 bucket.
• Create EBS snapshots of the instance volume on a regular schedule with Amazon Data Lifecycle Manager.
• Store database backups in a different AWS region for disaster recovery.
• Never store the master password or key file in the same location as the database backup.

Configure Windows Firewall rules

Review the Windows Firewall configuration and restrict inbound and outbound traffic to only what is necessary.

Keep software updated

Update KeePass and Windows Server regularly to get the latest security patches and bug fixes. To check for KeePass updates, choose Help, then Check for Updates in the KeePass menu.

Use an Elastic IP

Assign an Elastic IP to your instance to keep a consistent IP address across stop and start cycles. This lets you keep your security group rules consistent.

Enable CloudWatch monitoring

Configure Amazon CloudWatch to monitor your instance metrics. Set up alarms that notify you if the instance stops unexpectedly or if unusual activity is detected.

Audit access with CloudTrail

Enable AWS CloudTrail to log all API activity related to your EC2 instance. The resulting audit trail shows who accessed or modified the instance and when, which matters for a security-sensitive workload such as password management.

Lock the database on inactivity

Configure KeePass to lock the database automatically after a period of inactivity. Choose Tools, then Options, then Security, and enable the auto lock settings. This protects the database if you step away from your RDP session.

Support

If you run into an issue that this guide does not cover, the SecureAnyCloud support team can help.

• Email: sales@secureanycloud.com
• Phone: (+44) 02045382725
• Website: secureanycloud.com
• Address: 3rd Floor, 86 90 Paul Street, London, EC2A 4NE

Support covers issues related to the AMI, including connectivity problems, software configuration and general guidance on using the preconfigured environment.

When you contact support, include your EC2 instance ID, the AWS region and a description of the issue, with any relevant error messages or screenshots. Never share your KeePass master password or database file with support personnel.

Deploy on AWS

Launch KeePass with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com