SendSSHPublicKey
AWS
SendSSHPublicKey
Event
Pushes a temporary SSH public key to an EC2 instance via EC2 Instance Connect, valid for 60 seconds.
Security Context
- Creating long-lived access keys or credentials provides persistent access that survives password resets and session revocations.
- SSH-based lateral movement provides adversaries with interactive command-line access to other compute instances in the environment.
Log Source
CloudTrail
Sample Event
Adversarial. Draco pushes a temporary 60-second SSH key to i-0occamy0000000001 as the ec2-user OS user. Once published, he has 60 seconds to SSH from 203.0.113.66 and spawn an OS-level shell — at which point persistence on the host (cron, systemd unit, etc.) becomes a separate problem from the AWS control plane. T1098.004 / T1021.004.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T20:24:13Z", "eventSource": "ec2-instance-connect.amazonaws.com", "eventName": "SendSSHPublicKey", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "instanceId": "i-0occamy0000000001", "instanceOSUser": "ec2-user", "sSHPublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdracoExfilKey203011366FantasticLogsExampleAAAAA draco@malfoy-manor", "availabilityZone": "us-east-1a" }, "responseElements": { "requestId": "90000000-0000-4000-8000-000110101010", "success": true }, "requestID": "90000000-0000-4000-8000-000110101010", "eventID": "90000000-0000-4000-8000-000110101011", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2-instance-connect.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Lateral Movement Persistence
Techniques:
- T1098.004 — SSH Authorized Keys — Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</...
- T1021.004 — SSH — Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.