Status: IN
EC2 Instance Connect SSH sessions can be audited by filtering CloudTrail events by source `ec2-instance-connect.amazonaws.com` and event name `SendSSHPublicKey`.
Source: entries/2026/03/11/AWSEC2-latest-APIReference-using-cloudtrailhtml.md