AppStream fleet idle timeout is 10 minutes or less

Check ID: appstream_fleet_session_idle_disconnect_timeout
Provider: AWS
Service: appstream
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon AppStream fleets are evaluated for the idle disconnect timeout setting, confirming it is configured to 10 minutes (<=600s) or less before inactive users are dropped and the session’s disconnect_timeout window begins.

Risk

Long idle sessions keep desktops/apps accessible without user presence, enabling session hijacking, shoulder surfing, and data exposure. They also consume capacity and extend billing, reducing availability for other users.

Recommendation

Configure an idle disconnect timeout 10 minutes. Pair with a short disconnect_timeout, require re-authentication on reconnect, and enforce least privilege. Monitor session metrics and adjust per role to balance security, cost, and user experience.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws appstream update-fleet —name <FLEET_NAME> —idle-disconnect-timeout-in-seconds 600

resource "aws_appstream_fleet" "<example_resource_name>" {
  name          = "<example_resource_name>"
  instance_type = "stream.standard.small"
  image_name    = "<IMAGE_NAME>"

  compute_capacity {
    desired_instances = 1
  }

  idle_disconnect_timeout_in_seconds = 600  # Critical: enforce <= 10 minutes to pass the check
}

Resources:
  <example_resource_name>:
    Type: AWS::AppStream::Fleet
    Properties:
      Name: <example_resource_name>
      InstanceType: stream.standard.small
      ComputeCapacity:
        DesiredInstances: 1
      IdleDisconnectTimeoutInSeconds: 600  # Critical: set to 10 minutes or less to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = appstream_fleet_session_idle_disconnect_timeout. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AppStream fleet disconnect timeout is 5 minutes or less AWS AppSync API has field-level logging set to ALL or ERROR

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires