Separate Session Manager shell transcripts from SSH and port-forwarding tunnels

A Session Manager connection record does not mean every tunneled command has a readable transcript.

Source facts

AWS states that Session Manager can record session commands and output according to session preferences. Logging is not available for Session Manager sessions using SSH or port forwarding: Session Manager serves as a tunnel for the SSH connection. AWS also warns that sensitive information entered during logged sessions can appear in the logs and describes options for limiting echoed secret input.

Source: AWS — Enabling and disabling session logging.

Applicability

This applies to AWS Systems Manager Session Manager. Connection history, shell content, operating-system auditing and application activity are different evidence types with separate configuration needs.

DSE recommendation

DSE recommends classifying approved remote-access methods before selecting audit controls. Record which methods produce shell transcripts and which require another source of command or application evidence. Give log readers only the access needed for their role and define a retention owner. Provide operators with an approved way to handle credentials without printing them. Do not claim full session recording merely because the connection passed through Session Manager. Publish a small access-method matrix for support showing the evidence expected from each permitted session type. Require the workload owner to approve the compensating audit source for tunnel-based access before anyone describes the resulting access path as fully recorded.

Verification

Proposed verification: in an authorized environment, compare an ordinary shell session with the permitted tunnel methods. Confirm the expected log destination and actual captured fields for each. Use harmless sample commands, never real passwords. Record any unobservable activity and its compensating evidence source in the access-control design.

Official reference

AWS — Enabling and disabling session logging. Reviewed October 20, 2026.