{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/aws-ssm-session-manager-transcript-tunnel-boundary/", "item": { "id": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/", "slug": "aws-ssm-session-manager-transcript-tunnel-boundary", "url": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary.md", "json": "https://update.dsesecurity.com/api/v1/posts/aws-ssm-session-manager-transcript-tunnel-boundary/" }, "title": "Separate Session Manager shell transcripts from SSH and port-forwarding tunnels", "summary": "A Session Manager connection record does not mean every tunneled command has a readable transcript.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:14:04+00:00", "modified_at": "2026-10-20T18:34:30+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 277, "potentially_affected": "This applies to AWS Systems Manager Session Manager. Connection history, shell content, operating-system auditing and application activity are different evidence types with separate configuration needs.", "dse_recommendation": "DSE recommends classifying approved remote-access methods before selecting audit controls.", "primary_source": { "name": "AWS — Enabling and disabling session logging", "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A Session Manager connection record does not mean every tunneled command has a readable transcript.

\n

Source facts

\n

AWS states that Session Manager can record session commands and output according to session preferences. Logging is not available for Session Manager sessions using SSH or port forwarding: Session Manager serves as a tunnel for the SSH connection. AWS also warns that sensitive information entered during logged sessions can appear in the logs and describes options for limiting echoed secret input.

\n

Source: AWS — Enabling and disabling session logging.

\n

Applicability

\n

This applies to AWS Systems Manager Session Manager. Connection history, shell content, operating-system auditing and application activity are different evidence types with separate configuration needs.

\n

DSE recommendation

\n

DSE recommends classifying approved remote-access methods before selecting audit controls. Record which methods produce shell transcripts and which require another source of command or application evidence. Give log readers only the access needed for their role and define a retention owner. Provide operators with an approved way to handle credentials without printing them. Do not claim full session recording merely because the connection passed through Session Manager. Publish a small access-method matrix for support showing the evidence expected from each permitted session type. Require the workload owner to approve the compensating audit source for tunnel-based access before anyone describes the resulting access path as fully recorded.

\n

Verification

\n

Proposed verification: in an authorized environment, compare an ordinary shell session with the permitted tunnel methods. Confirm the expected log destination and actual captured fields for each. Use harmless sample commands, never real passwords. Record any unobservable activity and its compensating evidence source in the access-control design.

\n

Official reference

\n

AWS — Enabling and disabling session logging. Reviewed October 20, 2026.

", "content_text": "A Session Manager connection record does not mean every tunneled command has a readable transcript.\nSource facts\nAWS states that Session Manager can record session commands and output according to session preferences. Logging is not available for Session Manager sessions using SSH or port forwarding: Session Manager serves as a tunnel for the SSH connection. AWS also warns that sensitive information entered during logged sessions can appear in the logs and describes options for limiting echoed secret input.\nSource: AWS — Enabling and disabling session logging.\nApplicability\nThis applies to AWS Systems Manager Session Manager. Connection history, shell content, operating-system auditing and application activity are different evidence types with separate configuration needs.\nDSE recommendation\nDSE recommends classifying approved remote-access methods before selecting audit controls. Record which methods produce shell transcripts and which require another source of command or application evidence. Give log readers only the access needed for their role and define a retention owner. Provide operators with an approved way to handle credentials without printing them. Do not claim full session recording merely because the connection passed through Session Manager. Publish a small access-method matrix for support showing the evidence expected from each permitted session type. Require the workload owner to approve the compensating audit source for tunnel-based access before anyone describes the resulting access path as fully recorded.\nVerification\nProposed verification: in an authorized environment, compare an ordinary shell session with the permitted tunnel methods. Confirm the expected log destination and actual captured fields for each. Use harmless sample commands, never real passwords. Record any unobservable activity and its compensating evidence source in the access-control design.\nOfficial reference\nAWS — Enabling and disabling session logging. Reviewed October 20, 2026.", "content_markdown": "A Session Manager connection record does not mean every tunneled command has a readable transcript.\n\n## Source facts\n\nAWS states that Session Manager can record session commands and output according to session preferences. Logging is not available for Session Manager sessions using SSH or port forwarding: Session Manager serves as a tunnel for the SSH connection. AWS also warns that sensitive information entered during logged sessions can appear in the logs and describes options for limiting echoed secret input.\n\nSource: [AWS — Enabling and disabling session logging](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html).\n\n## Applicability\n\nThis applies to AWS Systems Manager Session Manager. Connection history, shell content, operating-system auditing and application activity are different evidence types with separate configuration needs.\n\n## DSE recommendation\n\nDSE recommends classifying approved remote-access methods before selecting audit controls. Record which methods produce shell transcripts and which require another source of command or application evidence. Give log readers only the access needed for their role and define a retention owner. Provide operators with an approved way to handle credentials without printing them. Do not claim full session recording merely because the connection passed through Session Manager. Publish a small access-method matrix for support showing the evidence expected from each permitted session type. Require the workload owner to approve the compensating audit source for tunnel-based access before anyone describes the resulting access path as fully recorded.\n\n## Verification\n\nProposed verification: in an authorized environment, compare an ordinary shell session with the permitted tunnel methods. Confirm the expected log destination and actual captured fields for each. Use harmless sample commands, never real passwords. Record any unobservable activity and its compensating evidence source in the access-control design.\n\n## Official reference\n\n[AWS — Enabling and disabling session logging](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/", "url": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Separate Session Manager shell transcripts from SSH and port-forwarding tunnels", "item": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/#article", "identifier": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/", "url": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/", "headline": "Separate Session Manager shell transcripts from SSH and port-forwarding tunnels", "description": "A Session Manager connection record does not mean every tunneled command has a readable transcript.", "abstract": "A Session Manager connection record does not mean every tunneled command has a readable transcript.", "articleBody": "A Session Manager connection record does not mean every tunneled command has a readable transcript.\nSource facts\nAWS states that Session Manager can record session commands and output according to session preferences. Logging is not available for Session Manager sessions using SSH or port forwarding: Session Manager serves as a tunnel for the SSH connection. AWS also warns that sensitive information entered during logged sessions can appear in the logs and describes options for limiting echoed secret input.\nSource: AWS — Enabling and disabling session logging.\nApplicability\nThis applies to AWS Systems Manager Session Manager. Connection history, shell content, operating-system auditing and application activity are different evidence types with separate configuration needs.\nDSE recommendation\nDSE recommends classifying approved remote-access methods before selecting audit controls. Record which methods produce shell transcripts and which require another source of command or application evidence. Give log readers only the access needed for their role and define a retention owner. Provide operators with an approved way to handle credentials without printing them. Do not claim full session recording merely because the connection passed through Session Manager. Publish a small access-method matrix for support showing the evidence expected from each permitted session type. Require the workload owner to approve the compensating audit source for tunnel-based access before anyone describes the resulting access path as fully recorded.\nVerification\nProposed verification: in an authorized environment, compare an ordinary shell session with the permitted tunnel methods. Confirm the expected log destination and actual captured fields for each. Use harmless sample commands, never real passwords. Record any unobservable activity and its compensating evidence source in the access-control design.\nOfficial reference\nAWS — Enabling and disabling session logging. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:14:04+00:00", "dateModified": "2026-10-20T18:34:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/aws-ssm-session-manager-transcript-tunnel-boundary/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Session Manager shell transcripts from SSH and port-forwarding tunnels" }, "articleSection": [ "Business Continuity", "Cybersecurity", "IT" ], "keywords": [ "Business Continuity", "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 277, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS — Enabling and disabling session logging", "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html" } } ] } }