--- title: How to Audit SSH Sessions in Amazon EC2 | daily.dev description: A step-by-step walkthrough shows how to configure SSH session recording and auditing for Amazon EC2 instances using Teleport. It covers reviewing recorded... canonical: https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Audit SSH Sessions in Amazon EC2 | daily.dev og:description: A step-by-step walkthrough shows how to configure SSH session recording and auditing for Amazon EC2 instances using Teleport. It covers reviewing recorded... og:url: https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs og:image: https://api.daily.dev/og/posts/IL55Xk5BS.png og:image:alt: How to Audit SSH Sessions in Amazon EC2 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Audit SSH Sessions in Amazon EC2 **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary A step-by-step walkthrough shows how to configure SSH session recording and auditing for Amazon EC2 instances using Teleport. It covers reviewing recorded sessions through the web UI and CLI (tsh play), reading Teleport's event log, and configuring the auth server to persist audit events in Amazon DynamoDB and session recordings in Amazon S3 for high availability. A scenario involving a contractor disabling AppArmor illustrates how recorded sessions help diagnose security incidents. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I play back a recorded SSH session in Teleport from the command line? Use the tsh play command with the proxy address and session ID, for example: tsh play --proxy=tele.j-access.in 0b724167-82e7-4c4b-95d2-a79d2c899170. Adding the --format=json switch prints the session events as JSON instead of replaying the video, which is useful for scripted analysis or auditing. _daily.dev surfaces practical guides like this for teams building SSH audit workflows with Teleport._ ### How do I store Teleport session recordings and audit logs in AWS instead of the local auth server disk? Configure the storage section of /etc/teleport.yaml with audit_sessions_uri pointing to an S3 bucket path (e.g. s3://bucket-name/records) and audit_events_uri pointing to a DynamoDB table (e.g. dynamodb://teleport-events), alongside optional file and stdout destinations. The EC2 instance running the Teleport auth server needs an IAM role with S3FullAccess and AmazonDynamoDBFullAccess policies attached. _Engineers designing durable audit storage for SSH access can track setups like this on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#logging](https://daily.dev/tags/logging), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Audit SSH Sessions in Amazon EC2","url":"https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs"},"datePublished":"2026-08-23T12:19:11.099Z","dateModified":"2026-10-14T02:23:54.003Z","description":"A step-by-step walkthrough shows how to configure SSH session recording and auditing for Amazon EC2 instances using Teleport. It covers reviewing recorded...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,logging,ssh","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to Audit SSH Sessions in Amazon EC2"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-audit-ssh-sessions-in-amazon-ec2-il55xk5bs#faq","mainEntity":[{"@type":"Question","name":"How do I play back a recorded SSH session in Teleport from the command line?","acceptedAnswer":{"@type":"Answer","text":"Use the tsh play command with the proxy address and session ID, for example: tsh play --proxy=tele.j-access.in 0b724167-82e7-4c4b-95d2-a79d2c899170. Adding the --format=json switch prints the session events as JSON instead of replaying the video, which is useful for scripted analysis or auditing. daily.dev surfaces practical guides like this for teams building SSH audit workflows with Teleport."}},{"@type":"Question","name":"How do I store Teleport session recordings and audit logs in AWS instead of the local auth server disk?","acceptedAnswer":{"@type":"Answer","text":"Configure the storage section of /etc/teleport.yaml with audit_sessions_uri pointing to an S3 bucket path (e.g. s3://bucket-name/records) and audit_events_uri pointing to a DynamoDB table (e.g. dynamodb://teleport-events), alongside optional file and stdout destinations. The EC2 instance running the Teleport auth server needs an IAM role with S3FullAccess and AmazonDynamoDBFullAccess policies attached. Engineers designing durable audit storage for SSH access can track setups like this on daily.dev."}}]} ```