Operators use Session Manager to reach private instances. A later review asks which commands ran in a session, and nothing was recorded. What should be configured so later sessions can be reviewed?
Select an answer to reveal the explanation.
Short Explanation
A hallway camera shows that a door opened, not what was said in the room. Session Manager can record the session itself when its preferences send logs to an S3 bucket or a CloudWatch Logs log group, and that is what a later review can read. A flow log or a CloudTrail API record does not store the commands typed in the session, and the sessions you already finished were not captured.
Full Explanation
Session Manager preferences can send session logs to an S3 bucket or a CloudWatch Logs log group. That log is the record of the session, which is what a later review reads when it asks which commands ran. Nothing was recorded this time because that preference was not set, so the next sessions are the ones that will have a log. VPC flow logs store addresses, ports, and whether the flow was accepted. They do not store shell commands. CloudTrail records the Session Manager API calls, such as the start of a session. It does not store the keystrokes inside the session. Inspector looks for vulnerabilities and network exposure. It does not write a transcript of an interactive session. Caveat: logging applies to sessions that start after the preference is saved, and the instance profile needs permission to write to the bucket or log group or the new session still produces an empty trail. Operational check: start one new session, run a harmless command, and confirm that command appears in the chosen S3 object or CloudWatch log stream.