View or Terminate Root User Active Sessions

0

Is there a way that I can check if there's any sessions previously created by a root user logging into a root account via a https://*.signin.aws.amazon.com/console link that are currently still active?

preguntada hace un año507 visualizaciones
4 Respuestas
0

You can use Systems Manager to view information about sessions in your account.

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-view-history.html

Sachin
respondido hace un año
  • The Systems Manager / Session Manager page doesn't show any sessions. Is that expected or should it show the current session?

0

According to the Console FAQ, console sessions only last 12 hours until they have to reauthenticate. So, you should be able to query the CloudTrail logs for root logins less than 12 hours.

profile pictureAWS
EXPERTO
kentrad
respondido hace un año
  • I'm not really familiar with CloudTrial, but have built a query using the examples as a guide; "SELECT * FROM $EDS_ID". This shows no results, even though I signed in within the last 15 mins... Am I querying the wrong table?

0

CloudTrail records sign-in events including root's, but not sure if active session details are available anywhere.

for cloudTrail details you can check below link.

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html#cloudtrail-event-reference-aws-console-sign-in-events-root

Sachin
respondido hace un año
0

CloudTrial doesn't have anything configured.

To be specific; I'm looking to see what current sessions exist in a new account without anything configured or created.

An account was created the account on a machine that is no longer accessible. I want to either see the login activity from that machine to make sure I'm happy no-one could use the account or or at least ensure that any sessions created so far are all fully terminated.

Is there any way to do either of those options?

respondido hace un año

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas