AppStream fleet disconnect timeout is 5 minutes or less

Check ID: appstream_fleet_session_disconnect_timeout
Provider: AWS
Service: appstream
Severity: MEDIUM
Resource type: Other

What this check verifies

AppStream fleets are evaluated for DisconnectTimeoutInSeconds being at or below 300 seconds (5 minutes), which defines how long a streaming session remains active after a user disconnects.

Risk

Long disconnect times keep sessions active, enabling session hijacking or unintended reconnection on lost/stolen devices. This raises data exposure (confidentiality), permits unauthorized actions (integrity), and ties up capacity and costs (availability/operations).

Recommendation

Set DisconnectTimeoutInSeconds to 300 or less across fleets. Pair with a short IdleDisconnectTimeoutInSeconds, require re-authentication on reconnect, and enforce least privilege. Monitor session events and use defense in depth (network restrictions, device posture) to reduce takeover risk.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws appstream update-fleet —name <example_resource_name> —disconnect-timeout-in-seconds 300

# Terraform: Set AppStream Fleet disconnect timeout to 5 minutes or less
resource "aws_appstream_fleet" "<example_resource_name>" {
  name          = "<example_resource_name>"
  instance_type = "stream.standard.medium"
  image_name    = "<example_image_name>"

  compute_capacity {
    desired_instances = 1
  }

  disconnect_timeout_in_seconds = 300  # CRITICAL: ensures timeout is <= 300s
}

# CloudFormation: Set AppStream Fleet disconnect timeout to 5 minutes or less
Resources:
  ExampleFleet:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: <example_resource_name>
      InstanceType: stream.standard.medium
      ImageName: <example_image_name>
      ComputeCapacity:
        DesiredInstances: 1
      DisconnectTimeoutInSeconds: 300  # CRITICAL: ensures session disconnect timeout is <= 300s

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = appstream_fleet_session_disconnect_timeout. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AppStream fleet session duration is under 10 hours AppStream fleet idle timeout is 10 minutes or less

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires