# Enable CloudWatch Logging for AWS SSM Session Manager

## **Introduction**
AWS Systems Manager (SSM) Session Manager provides secure access to EC2 instances, but logging session activity is crucial for auditing and compliance. By enabling CloudWatch logging, you can track who accessed instances, what commands were run, and store logs securely.


## **Step 1: Create a CloudWatch Log Group**
1. Navigate to **AWS CloudWatch Console** → Click **Logs** → **Log groups**.
2. Click **Create log group**.
3. Enter a **Log Group Name** (e.g., `/aws/ssm/session-logs`).
4. Choose an appropriate **Retention period**.
5. Click **Create**.


## **Step 2: Update IAM Role to Allow Logging**
The IAM role attached to EC2 instances must have permission to write to CloudWatch Logs.

1. Go to **AWS IAM Console** → **Roles**.
2. Find and select the `EC2SSMRole` role used for SSM.
3. Click **Attach Policies** → Search for `CloudWatchLogsFullAccess` (or create a custom policy if needed).
4. Click **Attach policy**.


## **Step 3: Enable Session Logging in SSM**
1. Go to **AWS Systems Manager Console** → **Session Manager**.
2. Click **Preferences**.
3. Click **Edit** and enable **Session logging**.
4. Select **CloudWatch Logs**.
5. Choose the **Log group** created in Step 1 (`/aws/ssm/session-logs`).
6. Click **Save**.


## **Step 4: Start a Session and Verify Logging**
1. Open a new SSM session:
   ```sh
   aws ssm start-session --target <INSTANCE_ID>
   ```
2. Run some commands inside the session.
3. Check the **CloudWatch Logs Console** → Navigate to `/aws/ssm/session-logs` to see logs.


## **Conclusion**
- **Enhanced security and auditing** with detailed session logs.
- **Easy tracking of user actions** for compliance and troubleshooting.
- **Seamless integration with CloudWatch** for centralized logging.

Now your SSM sessions are fully logged and auditable! 🚀