Privilege escalation EC2 T1098.004

Push SSH key via Instance Connect

Can push an SSH key via Instance Connect and log into an instance.

Grants escalation on its own.

ec2-instance-connect:SendSSHPublicKey
Key takeaway

On its own, ec2-instance-connect:SendSSHPublicKey can push an SSH key via Instance Connect and log into an instance. On a wide resource scope that alone reaches administrator access.

SendSSHPublicKey as the role 01 Attacker principal 02 Interactive session 03 Administrator
How an attacker moves from this permission.
Explore this in Pathbreak

Why it is dangerous

A principal can call ec2-instance-connect:SendSSHPublicKey to push an ephemeral SSH key onto running the instance and then SSH in over the network, landing on the box with OS-level code execution. From there the principal reads the instance's attached IAM role credentials from IMDS and pivots further. Unlike SSM Session Manager this requires a reachable SSH port (22) on the instance, so it only works where the network path exists.

In MITRE ATT&CK terms this maps to T1098.004, Account Manipulation: SSH Authorized Keys, under the lateral movement tactic. AWS records it in CloudTrail as SendSSHPublicKey. The call shows up in CloudTrail but blends into normal administration, so it needs a rule to stand out.

Detection

SendSSHPublicKey

Prerequisites

Target instance is running, carries an IAM role, and is reachable on its SSH port (22) from the attacker's position. Instance Connect, unlike SSM, does NOT bypass the network path or security groups.

MITRE ATT&CK

T1098.004 · Account Manipulation: SSH Authorized Keys

Tactic

Lateral Movement

Breaking the path

A control that would remove it: Restrict ec2-instance-connect:SendSSHPublicKey to break-glass principals; close inbound port 22 and prefer SSM Session Manager.

Whether to apply it depends on how the permission is used in your environment, so it is a business decision rather than an automatic fix. The same permission can be load-bearing in one account and pure risk in another.

Pathbreak confirms whether this path resolves in your account, ranks it against the others by how much it opens up, and uses your threat model and business context to show which paths are worth cutting.

Questions

What does ec2-instance-connect:SendSSHPublicKey allow?

Can push an SSH key via Instance Connect and log into an instance.

Can ec2-instance-connect:SendSSHPublicKey escalate privileges on its own?

Yes. Held on a broad enough resource it reaches administrator access with no other permission.

How is push SSH key via Instance Connect detected?

Watch for SendSSHPublicKey in CloudTrail. The call shows up in CloudTrail but blends into normal administration, so it needs a rule to stand out.

How do you break this path?

A control that would remove it is: Restrict ec2-instance-connect:SendSSHPublicKey to break-glass principals; close inbound port 22 and prefer SSM Session Manager. Whether to apply it depends on how the permission is used in your account, so it is a business decision rather than an automatic fix.

Which MITRE ATT&CK technique is this?

T1098.004, Account Manipulation: SSH Authorized Keys, under the lateral movement tactic.

Related paths

Same serviceHijack EC2 user-dataec2:ModifyInstanceAttributeSame servicePass role to EC2 fleetiam:PassRoleSame servicePass role to EKS node groupiam:PassRoleSame serviceInject user-data into EC2 launch templateec2:CreateLaunchTemplateVersionSame serviceHijack instance role via Instance Connectec2-instance-connect:SendSSHPublicKeySame servicePass role to Auto Scaling groupiam:PassRole

References

Find this in your own account

We run a read-only scan of one AWS account and show you which of these paths exist, ranked by blast radius, with the change that breaks each one. First validated paths within the hour.

Request a free scan Watch the 7-minute walkthrough