AWS systems-manager medium security documentation change
Summary
Added documentation about idle timeout behavior and strict session enforcement. Clarifies events that reset idle timer and recommends maximum session duration for strict limits.
Security assessment
Addresses potential session security risks by documenting how idle timeouts can be bypassed through certain events. Adds security documentation for enforcing strict session limits to prevent extended unauthorized access.
Diff
diff --git a/systems-manager/latest/userguide/session-preferences-timeout.md b/systems-manager/latest/userguide/session-preferences-timeout.md index 8ad88713d..739f190dd 100644 --- a//systems-manager/latest/userguide/session-preferences-timeout.md +++ b//systems-manager/latest/userguide/session-preferences-timeout.md @@ -12,0 +13,19 @@ Session Manager, a tool in AWS Systems Manager, allows you to specify the amount +###### Understanding idle timeout behavior + +The idle session timeout timer resets when Session Manager receives client-side inputs. These inputs include, but are not limited to: + + * Keyboard input in the terminal + + * Terminal or browser window resize events + + * Session reconnection (ResumeSession), which can occur due to network interruptions, browser tab management, or WebSocket disconnections + + + + +Because these events reset the idle timer, a session might remain active longer than the configured timeout period even without direct terminal commands. + +###### Enforcing strict session limits + +If your security requirements mandate strict session duration limits regardless of activity, use the _Maximum session duration_ setting in addition to idle timeout. For more information, see [Specify maximum session duration](./session-preferences-max-timeout.html). +