Skip to content

ImportKeyPair

AWS

ImportKeyPair

service: AWS - EC2
techniques:

Event

Imports an existing RSA or ED25519 public key into EC2 for use as a key pair when launching instances.

Security Context

  • Creating long-lived access keys or credentials provides persistent access that survives password resets and session revocations.
  • Lateral movement techniques allow adversaries to expand their foothold by accessing additional systems and services within the environment.

Log Source

CloudTrail

Sample Event

Adversarial — persistence. Draco imports an attacker-controlled SSH public key as draco-persistence-key into the production account. With iam:PassRole and a launch profile, he can spin up new EC2s with this key set as the launch keypair — surviving credential rotations and giving him a non-IAM lateral-movement path. T1098.004.

{
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDADRAC0MALF0YBADGY",
"arn": "arn:aws:iam::555123456789:user/draco",
"accountId": "555123456789",
"accessKeyId": "AKIADRAC0MALF0YEXAMP5",
"userName": "draco"
},
"eventTime": "2026-04-15T22:02:17Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "ImportKeyPair",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"keyName": "draco-persistence-key",
"publicKeyMaterial": "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUVYQU1QTEVFWEFNUExFRVhBTVBMRUVYQU1QTEVFWEFNUExFRVhBTSBkcmFjb0BraGFsaQo="
},
"responseElements": {
"requestId": "90000000-0000-4000-8000-000101001010",
"keyName": "draco-persistence-key",
"keyFingerprint": "f6:08:b6:ba:32:5b:dc:8d:7a:24:59:0c:88:36:14:73",
"keyPairId": "key-0badcafe000000666"
},
"requestID": "90000000-0000-4000-8000-000101001010",
"eventID": "90000000-0000-4000-8000-000101001011",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "555123456789",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Persistence Lateral Movement

Techniques:
  • T1098.004 — SSH Authorized Keys — Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</...
  • T1021.004 — SSH — Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.