> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ssm session length remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of SSM Session Length Should Be Minimum in AWS using AWS console, you can follow the below steps: 1. Login to your AWS console. 2. Go to the AWS Systems Manager console. 3. Click on the 'Managed Instances' option from the left navigation pane. 4. Select the instance for which you want to remediate the misconfiguration. 5. Click on the 'Actions' button and select 'Edit Managed Instance Settings'. 6. In the 'Edit Managed Instance Settings' page, scroll down to the 'SSM Agent Settings' section. 7. In the 'SSM Session Length' field, enter the minimum session length you want to set. 8. Click on the 'Save Changes' button. Once you have followed the above steps, the SSM Session Length will be set to the minimum value you have specified. This will help you remediate the misconfiguration of SSM Session Length Should Be Minimum in AWS. # The SSM Session Length should be set to a minimum for security reasons. To remediate this for AWS using AWS CLI, follow these steps: 1. Open the AWS CLI and run the following command to update the SSM Document: ``` aws ssm update-document --name "AWS-StartSSHSession" --content "{\"schemaVersion\":\"1.0\",\"description\":\"AWS Systems Manager document to start an SSH session to an instance\",\"parameters\":{\"portNumber\":{\"type\":\"String\",\"description\":\"The port number on which the SSH service is listening (usually 22)\",\"default\":\"22\"},\"sessionLength\":{\"type\":\"String\",\"description\":\"The duration of the session (in seconds)\",\"default\":\"3600\"}},\"mainSteps\":[{\"action\":\"aws:runShellScript\",\"name\":\"runShellScript\",\"inputs\":{\"runCommand\":[\"sudo sed -i 's/\\# ClientAliveInterval 0/ClientAliveInterval 300/g' /etc/ssh/sshd_config\",\"sudo sed -i 's/\\# ClientAliveCountMax 3/ClientAliveCountMax 0/g' /etc/ssh/sshd_config\",\"sudo service sshd restart\"]}}]}" ``` 2. This command will update the SSM Document with a new session length of 3600 seconds (1 hour). If you want to set a different session length, change the value of the `sessionLength` parameter in the command. 3. After the SSM Document is updated, you can use it to start an SSH session to an instance with the new session length. To start an SSH session, run the following command: ``` aws ssm start-session --target instance-id --document-name AWS-StartSSHSession --parameters '{"portNumber":["22"],"sessionLength":["3600"]}' ``` 4. Replace `instance-id` with the ID of the instance you want to connect to. 5. This command will start an SSH session with a session length of 3600 seconds (1 hour). If you want to set a different session length, change the value of the `sessionLength` parameter in the command. 6. After the SSH session is started, you can use it to perform any necessary actions on the instance. By following these steps, you can remediate the SSM Session Length misconfiguration in AWS. To remediate the misconfiguration of SSM session length being minimum in AWS using Python, you can follow the below steps: 1. Open the AWS Management Console and navigate to the EC2 service. 2. Select the instance for which you want to remediate the SSM session length. 3. Click on the "Actions" button and select "Instance Settings" and then "Modify IAM Role". 4. In the "Modify IAM Role" window, select the IAM role that has the required permissions to modify the SSM session length. 5. Once you have selected the IAM role, click on the "Save" button to save the changes. 6. Now, open your Python IDE and import the required libraries. ```python theme={null} import boto3 ``` 7. Create a boto3 session object and specify the region where your instance is located. ```python theme={null} session = boto3.Session(region_name='us-east-1') ``` 8. Create an SSM client object using the session object. ```python theme={null} ssm_client = session.client('ssm') ``` 9. Use the modify\_instance\_information() method to modify the SSM session length. ```python theme={null} response = ssm_client.modify_instance_information( InstanceId='instance-id', InstanceInformation={ 'SSMActivationId': 'activation-id', 'SSMActivationCode': 'activation-code', 'AgentVersion': 'LATEST', 'PingStatus': 'Online', 'PlatformType': 'Linux', 'PlatformName': 'Amazon Linux AMI', 'PlatformVersion': '2018.03', 'HostName': 'ec2-xx-xx-xxx-xxx.compute-1.amazonaws.com', 'IPAddress': 'xx.xx.xxx.xxx', 'ComputerName': 'ip-xx-xx-xxx-xxx', 'AssociationStatus': 'Success', 'LastAssociationExecutionDate': datetime(2019, 11, 22, 0, 0, tzinfo=tzlocal()), 'LastSuccessfulAssociationExecutionDate': datetime(2019, 11, 22, 0, 0, tzinfo=tzlocal()), 'AssociationOverview': { 'DetailedStatus': 'Success', 'InstanceAssociationStatusAggregatedCount': { 'Failed': 0, 'InProgress': 0, 'Success': 1, 'TimedOut': 0, 'NoStatus': 0 } } }, DesiredInstanceInformation={ 'SsmSessionDurationSeconds': 3600 } ) ``` 10. In the above code, replace the 'instance-id' with the ID of your instance and 'activation-id' and 'activation-code' with the activation ID and activation code of your SSM agent. 11. Also, modify the 'SsmSessionDurationSeconds' according to your requirement. Once you execute the above code, it will remediate the SSM session length misconfiguration for your AWS instance. Terraform cannot terminate an active SSM Session Manager session; the `aws_ssm` provider resources only manage configuration, not runtime sessions. To remediate this finding you must use the AWS CLI or console as per the verified fix: ```bash theme={null} aws ssm terminate-session \ --session-id YOUR_SESSION_ID_HERE \ --region YOUR_REGION_CODE_HERE ``` WARNING: This immediately terminates the active session; ensure this will not disrupt legitimate operations. In the console, go to Systems Manager → Session Manager → Sessions, identify the long‑running session, and choose “Terminate session.” There is no Terraform argument or resource that can perform this runtime action.