UpdateDevEndpoint
AWS
UpdateDevEndpoint
Event
Updates a Glue development endpoint, potentially injecting SSH public keys for unauthorized access.
Security Context
- Updating a dev endpoint’s SSH public key grants the attacker direct SSH access to the endpoint with the Glue service role’s credentials, bypassing normal authentication controls.
- This technique allows an adversary to inject their own SSH key into an existing endpoint, gaining interactive access to a compute resource with broad data permissions.
Log Source
CloudTrail
Sample Event
Adversarial. Draco injects his SSH public key into the existing Glue dev endpoint demiguise-glue-dev via UpdateDevEndpoint. Glue dev endpoints provide a Jupyter / Zeppelin / SSH-accessible compute environment that runs with the Glue service role’s IAM credentials — by adding his key to addPublicKeys, he gets an interactive session as if he were Newt (the legitimate user of DEMIGUISE/ML pipelines), with the role’s broad data-lake permissions. T1098.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T21:32:08Z", "eventSource": "glue.amazonaws.com", "eventName": "UpdateDevEndpoint", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "endpointName": "demiguise-glue-dev", "addPublicKeys": [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdracoExfilKey203011366FantasticLogsExampleAAAAA draco@malfoy-manor" ] }, "responseElements": null, "requestID": "90000000-0000-4000-8000-000111000110", "eventID": "90000000-0000-4000-8000-000111000111", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "glue.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Privilege Escalation
Techniques:
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...