Configure Agent Idle Session Timeout

Risk Level: Medium (should be achieved)

Ensure that your Amazon Bedrock Agents have an appropriate idle session timeout configured by setting the idleSessionTTLInSeconds parameter to a value that aligns with your organization's security posture. The idle session timeout defines the number of seconds for which Amazon Bedrock keeps information about a user's conversation with the agent. A user interaction remains active for the amount of time specified. If no conversation occurs during this time, the session expires and Amazon Bedrock deletes any data provided before the timeout. The idleSessionTTLInSeconds parameter accepts values between 60 seconds (1 minute) and 5400 seconds (90 minutes). The default idle session timeout for Amazon Bedrock Agents is 1800 seconds (30 minutes). An excessively high idle session timeout (e.g. greater than 3600 seconds) increases the risk that a compromised or hijacked session remains active for a prolonged period, expanding the blast radius of session-based attacks.

Security

Configuring an appropriate idle session timeout for Amazon Bedrock Agents is important because long-lived agent sessions increase the risk that an attacker can maintain persistent access to agent capabilities after initial compromise. A shorter idle session timeout forces re-authentication and limits the window of exposure for session-based attacks. By enforcing a reasonable timeout value, you reduce the potential impact of session hijacking, minimize unauthorized access to agent-connected resources, and ensure that stale sessions are cleaned up promptly.

Audit

To determine if your Amazon Bedrock Agents have an appropriate idle session timeout configured, perform the following operations:

Using AWS Console

Sign in to the AWS Management Console.
Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.
In the main navigation panel, under Build, select Agents Classic.
In the Agents Classic section, click on the name (link) of the agent that you want to examine, available in the Name column.
Choose Edit in Agent builder to access the agent configuration.
Expand the Additional settings section and check the Session timeout value configured under Idle session timeout. If the session timeout is set to an excessively high value (e.g. greater than 3600 seconds / 60 minutes), the idle session timeout configuration for the selected Amazon Bedrock agent is not following security best practices.
Repeat steps no. 4 – 6 for each Bedrock agent available within the current AWS region.
Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

Using AWS CLI

Run list-agents command (OSX/Linux/UNIX) to list the identifier (ID) and name of each Amazon Bedrock agent available in the selected AWS cloud region:
```
aws bedrock-agent list-agents
--region us-east-1
--query 'agentSummaries[*].[agentId,agentName]'
```

The command output should return the requested agent identifiers and names:

[
    [
        "ABCDACBDAB",
        "cc-support-agent"
    ],
    [
        "ABCABCABCA",
        "cc-research-agent"
    ]
]

Run get-agent command (OSX/Linux/UNIX) with the ID of the Amazon Bedrock agent that you want to examine as the identifier parameter and output query filters to describe the idle session timeout value configured for the selected agent:
```
aws bedrock-agent get-agent
--region us-east-1
--agent-id ABCDACBDAB
--query 'agent.idleSessionTTLInSeconds'
```
The command output should return the idle session timeout value (in seconds):
```
600
```
Check the idleSessionTTLInSeconds value returned by the get-agent command output. If the value is set to an excessively high number (e.g. greater than 3600 seconds), the idle session timeout configuration for the selected Amazon Bedrock agent is not following security best practices.
Repeat steps no. 3 and 4 for each Amazon Bedrock agent available in the selected AWS region.
Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other regions.

Remediation / Resolution

To configure an appropriate idle session timeout for your Amazon Bedrock Agents, perform the following operations:

Using AWS Console

Sign in to the AWS Management Console.
Navigate to Amazon Bedrock console available at https://console.aws.amazon.com/bedrock/.
In the main navigation panel, under Build, select Agents Classic.
In the Agents Classic section, click on the name (link) of the agent that you want to configure, available in the Name column.
Choose Edit in Agent builder to access the agent configuration.
Expand the Additional settings section, locate the Idle session timeout setting, and update the Session timeout value to an appropriate duration (e.g. 600 seconds / 10 minutes or an organization-appropriate value no greater than 3600 seconds / 60 minutes). Choose Save to apply the changes.
Select Prepare in the test window to apply the updated configuration to the agent's working draft. Without preparing, the changes will not take effect on deployed aliases.
Repeat steps no. 4 – 7 for each Bedrock agent that you want to configure, available within the current AWS region.
Change the AWS cloud region from the navigation bar to repeat the Remediation process for other regions.

Using AWS CLI

Run get-agent command (OSX/Linux/UNIX) to retrieve the current configuration of the Amazon Bedrock agent that you want to reconfigure (see Audit section part II to identify the right resource):
```
aws bedrock-agent get-agent
--region us-east-1
--agent-id ABCDACBDAB
--query 'agent.[agentName,foundationModel,agentResourceRoleArn]'
```

The command output should return the agent name, foundation model, and service role ARN required for the update command:

[
    "cc-support-agent",
    "anthropic.claude-sonnet-4-5-20250929-v1:0",
    "arn:aws:iam::123456789012:role/service-role/AmazonBedrockExecutionRoleForAgents"
]

Run update-agent command (OSX/Linux/UNIX) using the agent ID, agent name, foundation model, and agent resource role ARN retrieved at the previous step to update the idle session timeout to an appropriate value (e.g. 600 seconds). Note: The update-agent command overwrites all fields, so you must pass the existing values for --agent-name, --foundation-model, and --agent-resource-role-arn alongside the changed --idle-session-ttl-in-seconds to avoid accidentally clearing those fields:
```
aws bedrock-agent update-agent
--region us-east-1
--agent-id ABCDACBDAB
--agent-name cc-support-agent
--foundation-model anthropic.claude-sonnet-4-5-20250929-v1:0
--agent-resource-role-arn arn:aws:iam::123456789012:role/service-role/AmazonBedrockExecutionRoleForAgents
--idle-session-ttl-in-seconds 600
```

The command output should return the updated agent configuration confirming the new idle session timeout value:

{
    "agent": {
        "agentId": "ABCDACBDAB",
        "agentName": "cc-support-agent",
        "agentStatus": "NOT_PREPARED",
        "idleSessionTTLInSeconds": 600,
        "foundationModel": "anthropic.claude-sonnet-4-5-20250929-v1:0",
        "agentResourceRoleArn": "arn:aws:iam::123456789012:role/service-role/AmazonBedrockExecutionRoleForAgents"
    }
}

Repeat steps no. 1 – 4 for each Amazon Bedrock agent that you want to configure, available in the selected AWS region.
Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Remediation process for other regions.

References

AWS Documentation
Control agent session context
Create and configure agent manually
Automate tasks in your application using AI agents
GetAgent
UpdateAgent

AWS Command Line Interface (CLI) Documentation
list-agents
get-agent
update-agent

Publication date Jul 10, 2026

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS Console

Using AWS CLI

References

Related Bedrock rules