rage.fail

aws-ec2-instance-connect-ssh

derived aws emits CanExecuteCommand

match (effective permission)

{ "action": "ec2-instance-connect:SendSSHPublicKey", "resource_type": "AWS::EC2::Instance" }

where

?principal can reach the instance on tcp/22 (SG + route) -> CanReachPort instance running (service_state)

emit

source type	`Identity`
source	`<principal>`
target	`<EC2 instance>`
permissions	`ec2-instance-connect:SendSSHPublicKey`
conditions	`network_reachability` `service_state`
state logic	ACTIVE if tcp/22 reachable else CONDITIONAL(network_reachability)

Narrative

{principal.name} can push an ephemeral SSH key to {instance.name} (ec2-instance-connect:SendSSHPublicKey) and log in to run commands.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-instance-connect-ssh
emits: CanExecuteCommand
match_effective_permission:
  action: ec2-instance-connect:SendSSHPublicKey
  resource_type: AWS::EC2::Instance
where:
- ?principal can reach the instance on tcp/22 (SG + route) -> CanReachPort
- instance running (service_state)
emit:
  source_type: Identity
  source: <principal>
  target: <EC2 instance>
  permissions:
  - ec2-instance-connect:SendSSHPublicKey
  conditions:
  - network_reachability
  - service_state
  state_logic: ACTIVE if tcp/22 reachable else CONDITIONAL(network_reachability)
  false_positive_note: SendSSHPublicKey only pushes a 60-second key; without network reachability to port
    22 it grants nothing. Requires the OS user to exist and Instance Connect agent present (Amazon Linux
    2+/Ubuntu).
  narrative: '{principal.name} can push an ephemeral SSH key to {instance.name} (ec2-instance-connect:SendSSHPublicKey)
    and log in to run commands.'