Trying Out Disabling the Session ID with the AWS CLI Environment Variable AWS_CLI_SESSION_ID_DISABLED

Introduction

AWS CLI v2.36.14 (July 31, 2026) added the environment variable AWS_CLI_SESSION_ID_DISABLED to opt out of session ID collection.

curl -s https://raw.githubusercontent.com/aws/aws-cli/2.36.14/.changes/2.36.14.json | jq '.[] | select(.category == "``telemetry``")'
{
  "category": "``telemetry``",
  "description": "Add the ``AWS_CLI_SESSION_ID_DISABLED`` environment variable to opt out of session id collection.",
  "type": "enhancement"
}

In this article, I confirmed that setting AWS_CLI_SESSION_ID_DISABLED=true removes sid/ from the User-Agent. I also checked the impact on the CloudTrail userAgent and the conditions for values that enable it.

Test Environment

• AWS CLI v2.36.14 (Linux / aarch64)

Verification

What Is a Session ID?

AWS CLI adds a session ID (hereafter SID) to the User-Agent header of API requests in the form sid/xxxxxxxxxxxx. The generation logic is in awscli/telemetry.py, and it is a 12-character hash of host_id (a machine-specific UUID), tty (terminal name), and timestamp. It does not include command contents, arguments, resource names, or credentials.

Given this composition, it seems difficult to identify an individual or a machine from the SID alone.

The expiration is 30 minutes (_SESSION_LENGTH_SECONDS in awscli/telemetry.py), and if there is no activity for 30 minutes, a new SID is generated the next time a command is run. Since an expiration is set, it can be read that this is not a mechanism intended for long-term tracking.

When generating a SID, the session database is opened. As a use case for disabling it, the comment explicitly states avoiding the file locking overhead on network file systems (such as NFS).

# Set to "true" to skip collecting session ids entirely. Opting out avoids
# opening the session database, whose file locking can be expensive when the
# database lives on a network filesystem.

Checking the Difference with --debug

To eliminate the influence of other environment variables, I prepared a clean environment with env -i and compared the User-Agent from the --debug logs.

The User-Agent when run without the environment variable contained sid/.

User-Agent: aws-cli/2.36.14 ... md/installer#update-exe sid/xxxxxxxxxxxx md/distrib#...

When AWS_CLI_SESSION_ID_DISABLED=true was set, sid/xxxxxxxxxxxx disappeared.

User-Agent: aws-cli/2.36.14 ... md/installer#update-exe md/distrib#...

Impact on the CloudTrail userAgent

I created an EC2 security group in two patterns, without the environment variable and with AWS_CLI_SESSION_ID_DISABLED=true, and compared the userAgent.

The userAgent when run without the environment variable contained sid/.

aws-cli/2.36.14 ... md/installer#update-exe sid/xxxxxxxxxxxx md/distrib#...

When AWS_CLI_SESSION_ID_DISABLED=true was set, the sid/xxxxxxxxxxxx part was simply gone, and there were no other differences.

aws-cli/2.36.14 ... md/installer#update-exe md/distrib#...

The SID is an ID for telemetry collection, but it also remains in the CloudTrail userAgent. By parsing the userAgent in Athena, it should be possible to group operations from the same session (not verified in this article).

The Only Valid Value Is true (Case-Insensitive)

As of 2026-08-02, the AWS CLI environment variable reference did not mention AWS_CLI_SESSION_ID_DISABLED. The only basis for the valid values is the source code, and the interpretation of the environment variable is handled by ensure_boolean() in botocore's botocore/utils.py.

def ensure_boolean(val):
    if isinstance(val, bool):
        return val
    elif isinstance(val, str):
        return val.lower() == 'true'
    else:
        return False

For strings, only val.lower() == 'true' evaluates to true. Values such as "1" and "yes" were not evaluated as true in the source at the time of writing.

Summary

I confirmed the AWS telemetry collection ID (SID) and the behavior of disabling it with AWS_CLI_SESSION_ID_DISABLED.

The SID does not include command contents, arguments, resource names, or credentials, and because it is recorded in the CloudTrail userAgent, it could serve as a clue for tracing operations in the same session.

Unless you have a specific reason, I recommend using the default settings.

References

• AWS CLI CHANGELOG (GitHub) (entry for v2.36.14)
• AWS CLI Environment Variables Reference (AWS_CLI_SESSION_ID_DISABLED is not listed. Checked on: 2026-08-02)
• awscli/telemetry.py (GitHub)
• botocore/utils.py (ensure_boolean) (GitHub)