# How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/remote-access-authorization-and-monitoring

Recipe id: `remote-access-authorization-and-monitoring` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-ELP`
- KSI `KSI-MLA-LET`
- KSI `KSI-SVC-ASM`
- KSI `KSI-CNA-ULN`
- control `ac-17`
- control `ac-17.1`
- control `ac-17.2`
- control `ac-17.3`

## Collection

Kind: `cli`

```sh
# get-document
aws ssm get-document --name SSM-SessionManagerRunShell --document-version '$LATEST' --query Content --output text
# describe-sessions
aws ssm describe-sessions --state History --query 'Sessions[].{owner:Owner,target:Target,start:StartDate,end:EndDate,document:DocumentName,accessType:AccessType,maxDuration:MaxSessionDuration}'
# describe-client-vpn-endpoints
aws ec2 describe-client-vpn-endpoints --query 'ClientVpnEndpoints[].{id:ClientVpnEndpointId,transport:TransportProtocol,auth:AuthenticationOptions[].Type,connectionLog:ConnectionLogOptions,splitTunnel:SplitTunnel,sessionTimeoutHours:SessionTimeoutHours,serverCert:ServerCertificateArn,selfServicePortal:SelfServicePortalUrl}'
# describe-client-vpn-connections
aws ec2 describe-client-vpn-connections --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --query 'Connections[].{user:Username,commonName:CommonName,clientIp:ClientIp,established:ConnectionEstablishedTime,ended:ConnectionEndTime,status:Status,posture:PostureComplianceStatuses}'
# ec2-instance-no-public-ip
aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-no-public-ip --compliance-types NON_COMPLIANT
```

## Expected output

The Session Manager preferences document as JSON — s3BucketName, s3KeyPrefix, s3EncryptionEnabled, cloudWatchLogGroupName, cloudWatchEncryptionEnabled, cloudWatchStreamingEnabled, kmsKeyId, runAsEnabled, idleSessionTimeout and maxSessionDuration — which is your Region's entire remote-access logging and encryption configuration in one object. Then one row per terminated session from the past 30 days carrying Owner, Target, StartDate, EndDate, DocumentName, MaxSessionDuration and AccessType of Standard or JustInTime. Then per Client VPN endpoint the transport protocol tcp or udp, the authentication types in use (certificate-authentication, directory-service-authentication or federated-authentication), ConnectionLogOptions with Enabled plus CloudwatchLogGroup and CloudwatchLogStream, SplitTunnel, SessionTimeoutHours of 8, 10, 12 or 24 (default 24) and the server certificate ARN. Then per connection Username (Active Directory authentication only), CommonName, ClientIp, ConnectionEstablishedTime, ConnectionEndTime, Status and any PostureComplianceStatuses — active connections plus only those terminated within the last 60 minutes. Finally the EC2 instances AWS Config evaluated NON_COMPLIANT because a publicIp field is present in their configuration item.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

Both access paths exist in AWS GovCloud (US-East) and (US-West). Client VPN endpoints there operate using FIPS 140-3 validated cryptographic modules and a fixed cipher set — TLS 1.3 TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256; TLS 1.2 TLS-ECDHE-RSA/ECDSA-WITH-AES-256-GCM-SHA384 and the AES-128-GCM-SHA256 variants; data channel AES-256-GCM — and AWS advises using the exported client configuration file unmodified rather than configuring other ciphers, which makes AC-17(2) there largely a matter of not breaking the default. Systems Manager runs in both Regions; Change Manager and Incident Manager do not, and State Manager association history cannot be viewed, none of which this recipe touches. ec2-instance-no-public-ip is documented for all supported AWS Regions. Calls to these services must use SSL (HTTPS), and ARNs use partition arn:aws-us-gov

## Notes

The commands split cleanly across the control family, and the gap in the middle is the one to be honest about. AC-17(1) — automated monitoring and control of remote access — is what session history and connection logs deliver, with two documented blind spots. Session Manager does not log sessions that connect through port forwarding or SSH, because SSH encrypts the session data inside the TLS connection and Session Manager is only the tunnel; an operator who port-forwards leaves a session record with no command content behind it. And describe-sessions reaches back 30 days only, so anything longer is an S3 or CloudWatch Logs query against the destinations named in the preferences document, not an SSM call. Client VPN retention is shorter still — terminated connections drop out of the API after 60 minutes, which makes the log group named in ConnectionLogOptions the only durable record, and Username is populated only for Active Directory authentication, so certificate-authenticated users are identified by CommonName or not at all. AC-17(2) is the strongest link in GovCloud, where the endpoints are FIPS 140-3 modules by construction; the Session Manager equivalent is kmsKeyId in the preferences document, and it is empty unless you set it, so an empty kmsKeyId is a finding rather than a default. AC-17(3) — routing remote access through managed network access control points — is the one nothing here proves. Session Manager and a Client VPN endpoint are managed access points, and ec2-instance-no-public-ip is the closest negative check, but that rule applies only to IPv4 and only to AWS::EC2::Instance: an IPv6-reachable instance, a load balancer fronting SSH, or a third-party jump host is invisible to it. Read the result as 'no EC2 instance carries a public IPv4 address', which is a useful sentence and not the control. AC-17 itself — the documented usage restrictions, configuration requirements and per-type authorization — is a record you write, and this telemetry only shows whether the estate matches it. One warning to carry into the evidence package: Session Manager logs the commands entered and their output, so a credential typed into a session lands in the log group you are about to hand an assessor.

## References

- {"title":"AWS Systems Manager: enabling and disabling session logging (no logging for port forwarding or SSH sessions)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html"}
- {"title":"AWS Systems Manager: update Session Manager preferences (SSM-SessionManagerRunShell inputs — kmsKeyId, s3/cloudWatch logging, timeouts)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-configure-preferences-cli.html"}
- {"title":"AWS Systems Manager: configure session preferences (KMS key encryption of session data, session history logs, timeouts)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-configure-preferences.html"}
- {"title":"AWS CLI: ssm get-document (returns Content for a named document version)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/get-document.html"}
- {"title":"AWS CLI: ssm describe-sessions (--state Active|History; history covers the past 30 days)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-sessions.html"}
- {"title":"AWS CLI: ec2 describe-client-vpn-endpoints (ConnectionLogOptions, AuthenticationOptions, SessionTimeoutHours, SplitTunnel)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-client-vpn-endpoints.html"}
- {"title":"AWS CLI: ec2 describe-client-vpn-connections (active plus connections terminated in the last 60 minutes)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-client-vpn-connections.html"}
- {"title":"AWS Config managed rule: ec2-instance-no-public-ip (EC2_INSTANCE_NO_PUBLIC_IP, IPv4 only, all supported Regions)","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-no-public-ip.html"}
- {"title":"AWS Client VPN in AWS GovCloud (US) — FIPS 140-3 validated modules and the permitted cipher list","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-vpnclient.html"}
- {"title":"AWS Systems Manager in AWS GovCloud (US) — capability and feature differences","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ssm.html"}