AWS Systems Manager Session Manager is not configured to log sessions
- Severity
- Medium
- Service
- Systems Manager
- Check ID
- SSM_SESSIONS_NOT_LOGGED
What this check finds
Without session logging, there is no audit trail of interactive shell sessions opened via SSM Session Manager. This makes it impossible to detect lateral movement, privilege escalation, or data exfiltration that occurred through an SSM session. Logging to S3 or CloudWatch Logs is required by most compliance frameworks.
Passing looks like: Session Manager logs sessions.
How to fix it
Configure Session Manager preferences to log to S3 or CloudWatch Logs.
AWS CLI
aws ssm update-document --name SSM-SessionManagerRunShell with Content JSON specifying s3BucketName or cloudWatchLogGroupName
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
Systems Manager → Session Manager → Preferences → Edit → S3 bucket or CloudWatch Logs → Save.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| HIPAA Security Rule |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs