Back to Checks
aws

AppStream fleet session idle disconnect timeout is 10 minutes or less

appstream_fleet_session_idle_disconnect_timeout
Service: appstreamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon AppStream fleets are evaluated for the idle disconnect timeout setting, confirming it is configured to 10 minutes (<=600s) or less before inactive users are dropped and the session's disconnect_timeout window begins.

Prowler logoProwlerprowler-provider-aws

Risk

Long idle sessions keep desktops/apps accessible without user presence, enabling session hijacking, shoulder surfing, and data exposure. They also consume capacity and extend billing, reducing availability for other users.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks appstream_fleet_session_idle_disconnect_timeout

Recommendation

Configure an idle disconnect timeout 10 minutes. Pair with a short disconnect_timeout, require re-authentication on reconnect, and enforce least privilege. Monitor session metrics and adjust per role to balance security, cost, and user experience.

Remediation

CLI

aws appstream update-fleet --name <FLEET_NAME> --idle-disconnect-timeout-in-seconds 600

Terraform

resource "aws_appstream_fleet" "<example_resource_name>" {
  name          = "<example_resource_name>"
  instance_type = "stream.standard.small"
  image_name    = "<IMAGE_NAME>"

  compute_capacity {
    desired_instances = 1
  }

  idle_disconnect_timeout_in_seconds = 600  # Critical: enforce <= 10 minutes to pass the check
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: <example_resource_name>
      InstanceType: stream.standard.small
      ComputeCapacity:
        DesiredInstances: 1
      IdleDisconnectTimeoutInSeconds: 600  # Critical: set to 10 minutes or less to pass the check

Other

1Open the AWS Console and go to AppStream 2.0 > Fleets
2Select your fleet and click Edit
3Find "Idle disconnect timeout"
4Set it to 10 minutes (600 seconds) or less
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.appstream.appstream_client import appstream_client


class appstream_fleet_session_idle_disconnect_timeout(Check):
    """Check if there are AppStream Fleets with the idle disconnect timeout set to 10 minutes or less"""

    def execute(self):
        """Execute the appstream_fleet_session_idle_disconnect_timeout check"""

        # max_idle_disconnect_timeout_in_seconds, default: 600 seconds (10 minutes)
        max_idle_disconnect_timeout_in_seconds = appstream_client.audit_config.get(
            "max_idle_disconnect_timeout_in_seconds", 600
        )

        findings = []
        for fleet in appstream_client.fleets:
            report = Check_Report_AWS(metadata=self.metadata(), resource=fleet)

            if (
                fleet.idle_disconnect_timeout_in_seconds
                and fleet.idle_disconnect_timeout_in_seconds
                <= max_idle_disconnect_timeout_in_seconds
            ):
                report.status = "PASS"
                report.status_extended = f"Fleet {fleet.name} has the session idle disconnect timeout set to less than 10 minutes."

            else:
                report.status = "FAIL"
                report.status_extended = f"Fleet {fleet.name} has the session idle disconnect timeout set to more than 10 minutes."

            findings.append(report)

        return findings

References