AWS CLI ec2-instance-connect ssh seems to be broken

[nicocvn]

Output of brew config

HOMEBREW_VERSION: 6.0.18-84-gf7ee632
ORIGIN: https://github.com/Homebrew/brew
HEAD: f7ee632952fd4513cd1a43736a4e1973c4fc69ca
Last commit: 3 hours ago
Branch: main
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.6 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.6/bin/ruby
CPU: dodeca-core 64-bit arm_brava
Clang: 21.0.0 build 2100
Git: 2.50.1 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.6.2-arm64
CLT: 26.6.0.0.1781586589
Xcode: 26.6
Metal Toolchain: 17.0 (17F109)
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
    node@20

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built.

Run `brew link` on these:
  powershell

Description of issue

Command:

aws --profile SomeProfile ec2-instance-connect ssh --instance-id i-xxxxx

This fails with:

aws: [ERROR]: 7174 (AWS_ERROR_CAL_UNSUPPORTED_ALGORITHM): The specified algorithm is unsupported on this platform.

Collecting debug information with --debug shows that the error seems to come from awscrt and aws-c-cal (only showing the relevant bits):

2026-08-20 09:55:07,510 - MainThread - botocore.hooks - DEBUG - Event needs-retry.ec2.DescribeInstances: calling handler <bound method RetryHandler.needs_retry of <botocore.retries.standard.RetryHandler object at 0x10aa0a660>>
2026-08-20 09:55:07,510 - MainThread - botocore.retries.standard - DEBUG - Not retrying request.
2026-08-20 09:55:07,510 - MainThread - botocore.hooks - DEBUG - Event after-call.ec2.DescribeInstances: calling handler <bound method RetryQuotaChecker.release_retry_quota of <botocore.retries.standard.RetryQuotaChecker object at 0x10aa096a0>>
2026-08-20 09:55:07,511 - MainThread - awscli.customizations.ec2instanceconnect.ssh - DEBUG - Generate new ssh key and upload
2026-08-20 09:55:07,511 - MainThread - awscli.customizations.ec2instanceconnect.ssh - DEBUG - Generate Ed25519 Key
2026-08-20 09:55:07,511 - MainThread - awscli.clidriver - DEBUG - Exception caught in main()
Traceback (most recent call last):
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscli/clidriver.py", line 604, in main
    return command_table[parsed_args.command](remaining, parsed_args)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscli/clidriver.py", line 742, in __call__
    return command_table[parsed_args.operation](remaining, parsed_globals)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscli/customizations/commands.py", line 207, in __call__
    rc = self._run_main(parsed_args, parsed_globals)
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscli/customizations/ec2instanceconnect/ssh.py", line 232, in _run_main
    private_pem_bytes = self._generate_and_upload_ssh_key(
        parsed_args.instance_id,
        parsed_args.os_user,
        parsed_globals,
    )
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscli/customizations/ec2instanceconnect/ssh.py", line 317, in _generate_and_upload_ssh_key
    private_key = self._key_manager.generate_key()
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscli/customizations/ec2instanceconnect/ssh.py", line 447, in generate_key
    return ED25519.new_generate()
           ~~~~~~~~~~~~~~~~~~~~^^
  File "/opt/homebrew/Cellar/awscli/2.36.27/libexec/lib/python3.14/site-packages/awscrt/crypto.py", line 200, in new_generate
    return ED25519(binding=_awscrt.ed25519_new_generate())
                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
RuntimeError: 7174 (AWS_ERROR_CAL_UNSUPPORTED_ALGORITHM): The specified algorithm is unsupported on this platform.

aws: [ERROR]: 7174 (AWS_ERROR_CAL_UNSUPPORTED_ALGORITHM): The specified algorithm is unsupported on this platform.

AWS CLI version:

➜ aws --version
aws-cli/2.36.27 Python/3.14.7 Darwin/25.6.0 source/arm64

Installing the CLI (same version) using the Amazon package fixes the issue.

I was able to reproduce that issue on different environments so maybe filing a bug report would be more useful.

[oleksiivelychko]

I have been experiencing this problem since v2.36.20. I believe the root cause in the commit. As a workaround, I installed the AWS CLI using the official installer, which works well, and created aliases, for example $XDG_BIN_HOME/aws ec2-instance-connect ssh.

[nicocvn]

Thanks for confirming the issue. I am also able to "workaround" it by using the official package.

[oleksiivelychko]

UPD: The commit in aws-c-cal likely fixed the issue. With awscli v2.36.27, I connected to an EC2 instance using the AWS CLI installed via Homebrew. Thanks to the maintainers.