Amazon-ssm-agent: Configurable timeout for Session Manager sessions on the CLI

[tdmalone]

Apologies if this is not the right place to request this.

I was wanting to request the ability to configure the Session Manager session timeout when connecting via CLI.

When performing long-running jobs such as database imports - and therefore not actively interacting with the terminal - I'm occasionally seeing this:

SessionId: tim.malone-097bc8bd07a0dee95 : Your session timed out due to inactivity and has been terminated.

before the job has been completed.

Would it be possible to configure (or even remove) this timeout?

[ElijahLynn]

Getting this too and your post is top for a search of "Your session timed out due to inactivity and has been terminated" aws ssm. Mine times out after 30 minutes of a long running option and only solution is to use screen to background it so it completes. It is a workaround but high friction. It should detect that the terminal isn't idle.

Update: Interesting, I went to https://console.amazonaws-us-gov.com/systems-manager/session-manager/sessions to see all open sessions and it has some open from over 12 hours ago that were closed. Maybe this is a bug in the SSM client I am using, I am not using the one AWS published but one that was coded up by someone on our team.

[analogrithems]

I can't even find in the code where the session timeout is set. I think this could be a server side setting.

[vivek-jain-mt]

I am also in need of such feature. Is this being addressed? not sure if this is the right portal

[adamkendall1]

Yes, please give us the option to select a longer idle timeout. I'm getting tired of recovering files and deleting vim swap files...

[tdmalone]

I've had a chat to our SA about this and he's gonna see what he can do to reach out to the Session Manager team.

[GNOMES]

@tdmalone did your rep provide you any feedback?

[tdmalone]

@GNOMES There's an internal feature request for this and I'm now on the list of customers interested in it, so when there's an update I should hear more. You can probably get yourself added as well via your SA, account manager or possibly Support. If you have an NDA on your account you may also be able to get more information on timelines.

[harishkashyap]

+1. ec2 timeout defaults are annoying; what were you thinking when you were developing such a customer focussed tool?

[crossbam]

Yes, please add the ability to change the session idle timeout. My machine learning analysts are not happy with the short timeout.

[khonourhmrc]

We really should be able to use this as a complete terminal replacement, at the moment you can't run long-running task in this terminal without turning it into a service or some such. Timeout really needs to be configurable we'd really prefer not to have standard ssh access.

[nitikagoyal87]

Thanks for your feedback! We will look into this request.

[leelakrishnachava]

Good to see that at least the team has identified it and looking forward to seeing a positive response soon.

[jwagun]

I am looking forward to this feature too. 👍

[Johaik]

Are there any updates about this? I would really appreciate it if it would be

[kaiw1ng]

this has been launched:

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-timeout.html

[adamkendall1]

Aaaayyyyyyyyyy!!!! Good job, AWS team!

[tdmalone]

Announcement post for the above: https://aws.amazon.com/about-aws/whats-new/2020/11/aws-customize-the-idle-session-timeout-and-stream-session-logs-t/

Next question: how do we configure this programmatically? The new streaming logs enhancement launched at the same time is available via the existing SSM document (https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-configure-preferences-cli.html), but the idle timeout does not appear to be represented here.

Update: looks like its idleSessionTimeout, with the value provided in whole minutes.

[robpomeroy]

I'm using Session Manager to tunnel RDP connections (and also WinRM for Ansible management). Yesterday, two live RDP sessions were forcibly disconnected by a Session Manager timeout. _I was using/interacting with both RDP connections at the time_. So how does Session Manager determine what constitutes 'inactivity'?

Being able to increase the timeout to 60 minutes max is little more than a workaround if SSM kills active sessions without honouring network activity.

[robpomeroy]

Update: Interesting, I went to https://console.amazonaws-us-gov.com/systems-manager/session-manager/sessions to see all open sessions and it has some open from over 12 hours ago that were closed. Maybe this is a bug in the SSM client I am using, I am not using the one AWS published but one that was coded up by someone on our team.

@ElijahLynn - it might not be your client. I'm using the AWS CLI v2 + Session Manager plugin and sometimes I see stale sessions still "active" from days past. The associated activity (SSH/RDP/WinRM) has long since finished.

[robpomeroy]

Update: looks like its idleSessionTimeout, with the value provided in whole minutes.

@tdmalone idleSessionTimeout doesn't appear as a parameter in the AWS-StartPortForwardingSession document though. 😕

[nitikaaws]

Ability to configure idle session timeout is now supported. Please refer to below documentations for more details.

• https://docs.aws.amazon.com/systems-manager/latest/userguide/session-preferences-timeout.html
• https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-configure-preferences-cli.html

In case of issues with active sessions getting disconnected forcibly, please provide us with some more information like sessionId, aws region, ssm agent logs etc to investigate this further. Thanks!