# Set a total Session Manager duration for long-running staff sessions

> A total session limit gives an administrator a separate decision from how long an idle connection may remain open.

- Canonical URL: https://update.dsesecurity.com/updates/aws-ssm-session-manager-maximum-duration/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:07+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A total session limit gives an administrator a separate decision from how long an idle connection may remain open.

## Potentially affected

This applies to the Session Manager maximum-duration preference. The source does not guarantee that ending a session reverses commands already executed or supplies an application recovery procedure.

## DSE recommendation

DSE recommends choosing the duration from actual support and maintenance tasks, with input from the service owner.

## Article

A total session limit gives an administrator a separate decision from how long an idle connection may remain open.

## Source facts

Session Manager allows a maximum duration after which a session ends. AWS documents no maximum session duration by default. When enabled in Session Manager preferences, the configured value must be between one and 1,440 minutes. The setting controls the total session duration described by this page; AWS provides idle timeout as a separate preference topic.

Source: [AWS — Specify maximum session duration](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-max-timeout.html).

## Applicability

This applies to the Session Manager maximum-duration preference. The source does not guarantee that ending a session reverses commands already executed or supplies an application recovery procedure.

## DSE recommendation

DSE recommends choosing the duration from actual support and maintenance tasks, with input from the service owner. Record how an operator should reconnect safely and how lengthy approved work will be handed off. Avoid setting an arbitrarily short limit that encourages bypassing the approved access method. Include maximum duration in the remote-access checklist so a later preferences change receives the same review as other staff access controls. Ask the support owner to identify tasks that need a planned reconnection or handoff, and include those instructions beside the approved duration. Keep any temporary exception time-bounded in the access record and restore the intended preference after the authorized work.

## Verification

Proposed verification: in an authorized test environment, set a short temporary limit and observe when a harmless session ends. Record its start and end times and confirm the documented reconnection procedure works. Restore the approved production value after testing, then inspect the saved preference rather than relying only on the edit screen.

## Official reference

[AWS — Specify maximum session duration](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-max-timeout.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — Specify maximum session duration
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-max-timeout.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Set a total Session Manager duration for long-running staff sessions,” DSE Security, https://update.dsesecurity.com/updates/aws-ssm-session-manager-maximum-duration/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.