ImportKeyPair
AWS
ImportKeyPair
Event
Imports an existing RSA or ED25519 public key into EC2 for use as a key pair when launching instances.
Security Context
- Creating long-lived access keys or credentials provides persistent access that survives password resets and session revocations.
- Lateral movement techniques allow adversaries to expand their foothold by accessing additional systems and services within the environment.
Log Source
CloudTrail
Sample Event
Adversarial — persistence. Draco imports an attacker-controlled SSH public key as draco-persistence-key into the production account. With iam:PassRole and a launch profile, he can spin up new EC2s with this key set as the launch keypair — surviving credential rotations and giving him a non-IAM lateral-movement path. T1098.004.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco" }, "eventTime": "2026-04-15T22:02:17Z", "eventSource": "ec2.amazonaws.com", "eventName": "ImportKeyPair", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "keyName": "draco-persistence-key", "publicKeyMaterial": "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUVYQU1QTEVFWEFNUExFRVhBTVBMRUVYQU1QTEVFWEFNUExFRVhBTSBkcmFjb0BraGFsaQo=" }, "responseElements": { "requestId": "90000000-0000-4000-8000-000101001010", "keyName": "draco-persistence-key", "keyFingerprint": "f6:08:b6:ba:32:5b:dc:8d:7a:24:59:0c:88:36:14:73", "keyPairId": "key-0badcafe000000666" }, "requestID": "90000000-0000-4000-8000-000101001010", "eventID": "90000000-0000-4000-8000-000101001011", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Persistence Lateral Movement
Techniques:
- T1098.004 — SSH Authorized Keys — Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</...
- T1021.004 — SSH — Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.