Amazon Workspaces Session Logging
You set up amazon workspaces session logging by sending desktop login events to AWS CloudTrail. You also turn on Amazon CloudWatch metrics to track when users start or stop desktops. Most teams route these cloud logs into a central log store for security reviews. Still, desktop logs only show when a user opens a virtual machine. If a user has broad database roles inside that desktop, logs miss their actual queries. How amazon workspaces session logging works in AWS Amazon WorkSpaces is a clou
SSH Session Logging: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up amazon workspaces session logging by sending desktop login events to AWS CloudTrail. You also turn on Amazon CloudWatch metrics to track when users start or stop desktops. Most teams route these cloud logs into a central log store for security reviews. Still, desktop logs only show when a user opens a virtual machine. If a user has broad database roles inside that desktop, logs miss their actual queries.
How amazon workspaces session logging works in AWS
Amazon WorkSpaces is a cloud desktop service that gives users a remote Windows or Linux machine. When a person logs in, the service checks their name and password against a directory. After that check passes, the service streams the desktop screen to the user. During this process, the cloud platform records management events and basic session state changes.
AWS CloudTrail captures API calls made to the desktop service by admins and users. When someone creates, reboots, or deletes a desktop, CloudTrail writes a record of that action. It also logs when a user logs in through the client app. Each log entry includes the user identity, the source IP address, and the exact timestamp.
Amazon CloudWatch works alongside CloudTrail to track session health and usage metrics over time. You can set up CloudWatch Events to send alerts when a login succeeds or fails. Teams often forward these event streams to a storage bucket for long-term audit storage. You can also install host agents inside each virtual desktop to collect local system logs. Those host agents send operating system events out to your central log store.
What native desktop logs solve and what they miss
Native desktop logs prove when a user logged in and which IP address they used. They help operations teams track desktop fleet usage, find idle machines, and spot failed logins. Security teams use these records to see who opened a cloud desktop during an incident. This setup solves the basic problem of tracking who enters the virtual network perimeter.
Still, desktop login logs stop at the virtual machine boundary. Once a developer opens their remote desktop, they launch database clients and command line tools. CloudTrail and CloudWatch do not see the SQL queries or shell commands run inside. They only know that the user had an active screen stream at that hour.
Trying to fix this gap with local host agents inside every desktop creates new problems. Users with local admin rights on their cloud desktop can pause or break logging agents. Even when host agents work, they only see that a terminal app started up. They cannot parse encrypted database traffic or log individual queries sent to production servers.
SSH Session Logging: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Why teams need query and command visibility
Many companies use cloud desktops to keep production data off local laptops. Engineers log in to the remote desktop and then open sessions to internal databases. Because the desktop sits inside a trusted network, teams often share broad database accounts there. Every engineer on the team might use the same shared admin role from their desktop.
When an incident happens, the database only sees traffic coming from the desktop subnet. The desktop login log shows ten engineers had active desktops at that same moment. You cannot tie a specific drop table command back to a single human identity. Also, shared roles return raw customer data like emails, phone numbers, and card numbers.
To get real audit trails, you must log actions at the database and server level. You need a way to tie every single query and command to an individual user. You also need controls that approve sensitive commands before they run and mask private fields.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does AWS CloudTrail record commands run inside a WorkSpace?
No, CloudTrail only logs management API calls and initial desktop login events. It does not capture shell commands, database queries, or user actions inside the operating system.
How long does AWS store WorkSpaces login events by default?
CloudTrail stores event history for ninety days by default inside the AWS console. To keep logs longer, you must create a trail that sends logs to storage buckets.
Can users bypass host logging agents on their cloud desktop?
Yes, if users have local admin permissions on their virtual desktop, they can stop agents. That is why teams should log database and server traffic outside the user desktop.