Back to Checks
aws

AppStream fleet session disconnect timeout is 5 minutes or less

appstream_fleet_session_disconnect_timeout
Service: appstreamSeverity: medium
OfficialBuilt-inVerified
Resource Type:Other

AppStream fleets are evaluated for DisconnectTimeoutInSeconds being at or below 300 seconds (5 minutes), which defines how long a streaming session remains active after a user disconnects.

Prowler logoProwlerprowler-provider-aws

Risk

Long disconnect times keep sessions active, enabling session hijacking or unintended reconnection on lost/stolen devices. This raises data exposure (confidentiality), permits unauthorized actions (integrity), and ties up capacity and costs (availability/operations).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks appstream_fleet_session_disconnect_timeout

Recommendation

Set DisconnectTimeoutInSeconds to 300 or less across fleets. Pair with a short IdleDisconnectTimeoutInSeconds, require re-authentication on reconnect, and enforce least privilege. Monitor session events and use defense in depth (network restrictions, device posture) to reduce takeover risk.

Remediation

CLI

aws appstream update-fleet --name <example_resource_name> --disconnect-timeout-in-seconds 300

Terraform

# Terraform: Set AppStream Fleet disconnect timeout to 5 minutes or less
resource "aws_appstream_fleet" "<example_resource_name>" {
  name          = "<example_resource_name>"
  instance_type = "stream.standard.medium"
  image_name    = "<example_image_name>"

  compute_capacity {
    desired_instances = 1
  }

  disconnect_timeout_in_seconds = 300  # CRITICAL: ensures timeout is <= 300s
}

NativeIaC

# CloudFormation: Set AppStream Fleet disconnect timeout to 5 minutes or less
Resources:
  ExampleFleet:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: <example_resource_name>
      InstanceType: stream.standard.medium
      ImageName: <example_image_name>
      ComputeCapacity:
        DesiredInstances: 1
      DisconnectTimeoutInSeconds: 300  # CRITICAL: ensures session disconnect timeout is <= 300s

Other

1In the AWS console, go to Amazon AppStream 2.0 > Fleets
2Select the fleet <example_resource_name> and choose Edit
3Set Disconnect timeout to 5 minutes (300 seconds) or less
4Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.appstream.appstream_client import appstream_client


class appstream_fleet_session_disconnect_timeout(Check):
    """Check if there are AppStream Fleets with the session disconnect timeout set to 5 minutes or less"""

    def execute(self):
        """Execute the appstream_fleet_maximum_session_duration check"""

        # max_disconnect_timeout_in_seconds, default: 300 seconds (5 minutes)
        max_disconnect_timeout_in_seconds = appstream_client.audit_config.get(
            "max_disconnect_timeout_in_seconds", 300
        )

        findings = []
        for fleet in appstream_client.fleets:
            report = Check_Report_AWS(metadata=self.metadata(), resource=fleet)

            if fleet.disconnect_timeout_in_seconds <= max_disconnect_timeout_in_seconds:
                report.status = "PASS"
                report.status_extended = f"Fleet {fleet.name} has the session disconnect timeout set to less than 5 minutes."

            else:
                report.status = "FAIL"
                report.status_extended = f"Fleet {fleet.name} has the session disconnect timeout set to more than 5 minutes."

            findings.append(report)

        return findings

References