I tried disabling the session ID using the AWS CLI environment variable AWS_CLI_SESSION_ID_DISABLED

Introduction

In AWS CLI v2.36.14 (July 31, 2026), the environment variable AWS_CLI_SESSION_ID_DISABLED was added to opt out of session ID collection.

curl -s https://raw.githubusercontent.com/aws/aws-cli/2.36.14/.changes/2.36.14.json | jq '.[] | select(.category == "``telemetry``")'
{
  "category": "``telemetry``",
  "description": "Add the ``AWS_CLI_SESSION_ID_DISABLED`` environment variable to opt out of session id collection.",
  "type": "enhancement"
}

In this article, we confirmed that setting AWS_CLI_SESSION_ID_DISABLED=true removes sid/ from the User-Agent. We also examined the impact on CloudTrail's userAgent and the conditions under which valid values take effect.

Test Environment

• AWS CLI v2.36.14 (Linux / aarch64)

Test Details

What is a Session ID?

The AWS CLI appends a session ID (hereafter SID) to the User-Agent header of API requests in the format sid/xxxxxxxxxxxx. The generation logic is in awscli/telemetry.py, and it is a 12-character hash of host_id (machine-specific UUID), tty (terminal name), and timestamp. Command content, arguments, resource names, and credentials are not included.

Given this structure, it is considered difficult to identify an individual or machine from the SID alone.

The expiration time is 30 minutes (_SESSION_LENGTH_SECONDS in awscli/telemetry.py), and if there is no activity for 30 minutes, a new SID is generated upon the next command execution. The fact that an expiration time is set suggests this is not a mechanism designed for long-term tracking.

When generating a SID, the session database is opened. The comments explicitly state that one use case for disabling it is to avoid the overhead of file locking on network file systems (such as NFS).

# Set to "true" to skip collecting session ids entirely. Opting out avoids
# opening the session database, whose file locking can be expensive when the
# database lives on a network filesystem.

Checking the Difference with --debug

To eliminate the influence of other environment variables, we prepared a clean environment using env -i and compared the User-Agent from --debug logs.

The User-Agent when executed without the environment variable contained sid/.

User-Agent: aws-cli/2.36.14 ... md/installer#update-exe sid/xxxxxxxxxxxx md/distrib#...

When AWS_CLI_SESSION_ID_DISABLED=true was set, sid/xxxxxxxxxxxx disappeared.

User-Agent: aws-cli/2.36.14 ... md/installer#update-exe md/distrib#...

Impact on CloudTrail userAgent

We performed EC2 security group creation in two patterns — without the environment variable and with AWS_CLI_SESSION_ID_DISABLED=true — and compared the userAgent values.

The userAgent when executed without the environment variable contained sid/.

aws-cli/2.36.14 ... md/installer#update-exe sid/xxxxxxxxxxxx md/distrib#...

When AWS_CLI_SESSION_ID_DISABLED=true was set, the sid/xxxxxxxxxxxx portion was simply removed, and there were no other differences.

aws-cli/2.36.14 ... md/installer#update-exe md/distrib#...

The SID is an ID for telemetry collection, but it also remains in CloudTrail's userAgent. By parsing the userAgent with Athena, it should be possible to group operations within the same session (this was not verified in this article).

Only true (case-insensitive) is a Valid Value

As of August 2, 2026, AWS_CLI_SESSION_ID_DISABLED was not listed in the AWS CLI environment variable reference. The basis for valid values is the source code alone, and the interpretation of the environment variable is handled by ensure_boolean() in botocore's botocore/utils.py.

def ensure_boolean(val):
    if isinstance(val, bool):
        return val
    elif isinstance(val, str):
        return val.lower() == 'true'
    else:
        return False

For strings, only val.lower() == 'true' evaluates to true. Values such as "1" or "yes" were not evaluated as true in the source code at the time of writing.

Summary

We confirmed the behavior of the AWS telemetry collection ID (SID) and the disabling behavior via AWS_CLI_SESSION_ID_DISABLED.

The SID does not contain command content, arguments, resource names, or credentials, and since it is recorded in CloudTrail's userAgent, it can serve as a clue for tracing operations within the same session.

Unless there is a specific reason, we recommend leaving the setting at its default.

Reference Links

• AWS CLI CHANGELOG (GitHub) (v2.36.14 entry)
• AWS CLI Environment Variable Reference (AWS_CLI_SESSION_ID_DISABLED not listed. Confirmed on: 2026-08-02)
• awscli/telemetry.py (GitHub)
• botocore/utils.py (ensure_boolean) (GitHub)