That's what I thought, but I don't understand why ...
Here's your shell experiment (same result as from inside Emacs):
$ ssh -l ec2-user -o ControlMaster=auto -o ControlPath='tramp.%C' -o ControlPersist=no -e none xx.xxx.xxx.xxx
address@hidden: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
And here's my usual ssh command (which works):
ssh -i <path_to_public_key_file> -o ServerAliveInterval=5 -o ServerAliveCountMax=1 address@hidden
The ip address shows up in ~/.ssh/known_hosts as
xx.xxx.xxx.xxx ecdsa-sha2-nistp256 <key>
Does that provide any clues?
There is a vpn active on my system, but connections to aws aren't routed through it (so far as I can tell).
Could I edit the Tramp command in Emacs to include a reference to public key?