Back to Checks
aws

AppStream fleet maximum user session duration is less than 10 hours

appstream_fleet_maximum_session_duration
Service: appstreamSeverity: medium
OfficialBuilt-inVerified
Resource Type:Other

AppStream fleets enforce a maximum user session duration. This finding evaluates each fleet's configured limit against a threshold-default 10 hours (36000 seconds)-and identifies fleets whose session duration exceeds that limit.

Prowler logoProwlerprowler-provider-aws

Risk

Overlong sessions widen the window for session hijacking, lateral movement, and data exfiltration if endpoints or tokens are compromised. Reduced reauthentication weakens confidentiality and integrity, and extended access can increase costs and resource contention.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks appstream_fleet_maximum_session_duration

Recommendation

Configure the maximum session duration to <= 10 hours (e.g., 600 minutes) or less based on data sensitivity. Prefer shorter limits, enforce reauthentication on renewal, apply least privilege, and enable idle timeouts. Monitor session activity as part of defense in depth.

Remediation

CLI

aws appstream update-fleet --name <example_resource_name> --max-user-duration-in-seconds 3600

Terraform

# Terraform: Set AppStream Fleet session duration below 10 hours
resource "aws_appstream_fleet" "<example_resource_name>" {
  name                         = "<example_resource_name>"
  max_user_duration_in_seconds = 3600 # CRITICAL: ensures max session duration is < 10h to pass the check
}

NativeIaC

# CloudFormation: Set AppStream Fleet session duration below 10 hours
Resources:
  AppStreamFleet:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: "<example_resource_name>"
      MaxUserDurationInSeconds: 3600  # CRITICAL: ensures max session duration is < 10h to pass the check

Other

1Open the AWS Console and go to Amazon AppStream 2.0
2Click Fleets and select <example_resource_name>
3Click Edit
4Set Maximum session duration to a value under 10 hours (e.g., 3600 seconds)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.appstream.appstream_client import appstream_client


class appstream_fleet_maximum_session_duration(Check):
    """Check if there are AppStream Fleets with the user maximum session duration no longer than 10 hours"""

    def execute(self):
        """Execute the appstream_fleet_maximum_session_duration check"""

        # max_session_duration_seconds, default: 36000 seconds (10 hours)
        max_session_duration_seconds = appstream_client.audit_config.get(
            "max_session_duration_seconds", 36000
        )

        findings = []
        for fleet in appstream_client.fleets:
            report = Check_Report_AWS(metadata=self.metadata(), resource=fleet)

            if fleet.max_user_duration_in_seconds < max_session_duration_seconds:
                report.status = "PASS"
                report.status_extended = f"Fleet {fleet.name} has the maximum session duration configured for less that 10 hours."
            else:
                report.status = "FAIL"
                report.status_extended = f"Fleet {fleet.name} has the maximum session duration configured for more that 10 hours."

            findings.append(report)

        return findings

References