More Info:
Ensure that all active sessions in the AWS Session Manager do not exceed the period of time set in the rule settings. Sessions that are active for longer than expected could be the result of suspicious activity. Session manager gives users the ability to open a shell into EC2 instances or execute commands on containers running in ECS.Risk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of SSM Session Length Should Be Minimum in AWS using AWS console, you can follow the below steps:
- Login to your AWS console.
- Go to the AWS Systems Manager console.
- Click on the ‘Managed Instances’ option from the left navigation pane.
- Select the instance for which you want to remediate the misconfiguration.
- Click on the ‘Actions’ button and select ‘Edit Managed Instance Settings’.
- In the ‘Edit Managed Instance Settings’ page, scroll down to the ‘SSM Agent Settings’ section.
- In the ‘SSM Session Length’ field, enter the minimum session length you want to set.
- Click on the ‘Save Changes’ button.
Using CLI
Using CLI
The SSM Session Length should be set to a minimum for security reasons. To remediate this for AWS using AWS CLI, follow these steps:
- Open the AWS CLI and run the following command to update the SSM Document:
-
This command will update the SSM Document with a new session length of 3600 seconds (1 hour). If you want to set a different session length, change the value of the
sessionLengthparameter in the command. - After the SSM Document is updated, you can use it to start an SSH session to an instance with the new session length. To start an SSH session, run the following command:
-
Replace
instance-idwith the ID of the instance you want to connect to. -
This command will start an SSH session with a session length of 3600 seconds (1 hour). If you want to set a different session length, change the value of the
sessionLengthparameter in the command. - After the SSH session is started, you can use it to perform any necessary actions on the instance.
Using Python
Using Python
To remediate the misconfiguration of SSM session length being minimum in AWS using Python, you can follow the below steps:
- Open the AWS Management Console and navigate to the EC2 service.
- Select the instance for which you want to remediate the SSM session length.
- Click on the “Actions” button and select “Instance Settings” and then “Modify IAM Role”.
- In the “Modify IAM Role” window, select the IAM role that has the required permissions to modify the SSM session length.
- Once you have selected the IAM role, click on the “Save” button to save the changes.
- Now, open your Python IDE and import the required libraries.
- Create a boto3 session object and specify the region where your instance is located.
- Create an SSM client object using the session object.
- Use the modify_instance_information() method to modify the SSM session length.
- In the above code, replace the ‘instance-id’ with the ID of your instance and ‘activation-id’ and ‘activation-code’ with the activation ID and activation code of your SSM agent.
- Also, modify the ‘SsmSessionDurationSeconds’ according to your requirement.