Hey, is there a way how to interrupt ongoing user session? Use case: our security engineer identifies a malicious behaviour and we want to be able to immediately interrupt all the users’ ongoing sessions. Thank you!
Hi @Milos
Currently we can end the temporary STS sessions by revoking all the active sessions at the Role level as shown below.
Additionally you can ensure row level data security filters are configured to ensure users are accessing the correct data .
Thanks
Vinod
We are using sign-in through QuickSight without a custom IdP. Is there any particular built-in QS role attached to each QS-managed user? If so, how can I identify it for revoking ongoing sessions?
Were you able to resolve this or are you still running into this problem? It has been some time since there has been activity on this post but we still want to help you find a solution.
To my knowledge, there is no way in the Quicksight console to revoke access to an ongoing session. My suggestion would be to in the moment delete or deactivate the user, and also change the session length to limit the access.
Unfortunately, not:
- Removing a user will not interrupt their ongoing session immediately; it took some time (there is probably a caching mechanism in place)
- The QS console nor the API don’t support moving orphaned resources for users other than those in the default namespace. Therefore, authors lost their resources on deletion
- What do you mean by deactivating the user? I’m not familiar with this term.
- Session length - minimum is 15 minutes, which is too much in the case of a security incident. Even if not, how does embedding work if a session expires? Is the embedded SDK able to renew expired sessions automatically once they expire so regular users will not be interrupted from previewing dashboards?
- There is an option for managing AWS access portal sessions, but I need to investigate deeper.