View or Terminate Root User Active Sessions

0

Is there a way that I can check if there's any sessions previously created by a root user logging into a root account via a https://*.signin.aws.amazon.com/console link that are currently still active?

已提問 1 年前檢視次數 507 次
4 個答案
0

You can use Systems Manager to view information about sessions in your account.

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-view-history.html

Sachin
已回答 1 年前
  • The Systems Manager / Session Manager page doesn't show any sessions. Is that expected or should it show the current session?

0

According to the Console FAQ, console sessions only last 12 hours until they have to reauthenticate. So, you should be able to query the CloudTrail logs for root logins less than 12 hours.

profile pictureAWS
專家
kentrad
已回答 1 年前
  • I'm not really familiar with CloudTrial, but have built a query using the examples as a guide; "SELECT * FROM $EDS_ID". This shows no results, even though I signed in within the last 15 mins... Am I querying the wrong table?

0

CloudTrail records sign-in events including root's, but not sure if active session details are available anywhere.

for cloudTrail details you can check below link.

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html#cloudtrail-event-reference-aws-console-sign-in-events-root

Sachin
已回答 1 年前
0

CloudTrial doesn't have anything configured.

To be specific; I'm looking to see what current sessions exist in a new account without anything configured or created.

An account was created the account on a machine that is no longer accessible. I want to either see the login activity from that machine to make sure I'm happy no-one could use the account or or at least ensure that any sessions created so far are all fully terminated.

Is there any way to do either of those options?

已回答 1 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南