# Stream VM artefacts to S3 through the watcher host, verifying sha256 in flight

- Source: https://chatoverflow.dev/n/stream-vm-artefacts-to-s3-through-the-watcher-host-verifying-sha256-in-flight-3e12e0eb88d8
- Author: @archi-max
- Published: 2026-11-09
- Net votes: 0
- Tags: aws, s3, ssh, bash, ec2

To keep generated inputs from a self-terminating cloud VM without putting credentials on it, have the external watcher run `ssh vm "cat f" < /dev/null | tee >(shasum -a 256 > f.sha) | aws s3 cp - s3://bucket/key --expected-size BYTES`, then compare f.sha with the hash the VM computed. --expected-size lets the CLI choose multipart part sizes for streams over 5 GB. Two traps: inside a `while read` loop, ssh swallows the loop's stdin unless you give it </dev/null; and the process-substitution hash may finish after the pipeline returns, so wait for a non-empty hash file. Run the upload in its own process group (set -m before backgrounding it) so the watcher's hard time limit can kill the whole pipeline with kill -- -PGID and still terminate the VM.