Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Minimal logging for Session Manager port forwarding

0

We are moving to using Session Manager for access to our AWS infrastructure.

We are using logging to record all access into CloudWatch.

However, one use case requires port forwarding. We have tied this down so that only selected users can access this, and they can only get to one port on one server. Actions on that port are logged at the application level into a separate CloudWatch Log Group.

I understand why we cannot log what is done on the Port Forward session. However, it would be useful to at least have a log entry that says "User X started a Session Manager Session using Document Y at time Z". Then we would know to go and look in the other topic to see what was done.

Is this possible in any way?

Topics
Management & GovernanceSecurity, Identity, & Compliance
Tags
AWS Systems ManagerAWS Identity and Access ManagementAWS Account Management
Language
English

asked a year ago356 views

1 Answer
0
Accepted Answer

Unfortunately, logging for Session Manager sessions that use port forwarding is limited due to the nature of the connection. Session Manager serves only as a tunnel for these connections, and the session data is encrypted, which prevents detailed logging of the session content.

However, you can still achieve some level of logging for the initiation of these sessions. While you won't be able to log the specific actions taken during the port forwarding session, you can log when a session starts and who initiated it. This can be done through AWS CloudTrail.

CloudTrail logs AWS API calls, including those made to start Session Manager sessions. When a user starts a session, including one for port forwarding, CloudTrail will record this action. The log entry will include details such as:

  1. The identity of the user who started the session
  2. The time the session was initiated
  3. The document name used to start the session (which could be your custom document for port forwarding)
  4. The target instance ID

By enabling CloudTrail and directing these logs to CloudWatch Logs, you can create a log entry that closely matches your requirement: "User X started a Session Manager Session using Document Y at time Z".

To set this up:

  1. Ensure CloudTrail is enabled in your AWS account.
  2. Configure CloudTrail to send logs to CloudWatch Logs.
  3. In CloudWatch Logs, you can create metrics and alerts based on these session start events if needed.

This approach will give you visibility into when port forwarding sessions are initiated and by whom, which you can then correlate with your application-level logs in the separate CloudWatch Log Group. While it doesn't provide details about the actions taken during the session, it does offer a starting point for your audit trail.

Remember to inform your users that while the content of their port forwarding sessions isn't logged, the fact that they initiated a session is recorded for security and compliance purposes.
Sources
AWS Systems Manager Session Manager - AWS Systems Manager
Step 8: (Optional) Allow and control permissions for SSH connections through Session Manager - AWS Systems Manager
Logging session data using Amazon CloudWatch Logs (console) - AWS Systems Manager

answered a year ago

EXPERT

reviewed a year ago

  • RobbieMcAndrew
    a year ago

    I can see it in CloudTrail, and I will investigate getting it into CloudWatch from there. It would be nicer if this could be done from the SessionManager setup or Document, where we've set up the other session manager logging.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content