SCS-C02 Question 340
Single answerA company wants to provide secure remote access to its Amazon EC2 instances for system administrators. The company's security team has mandated that no SSH keys should be used, and all access should be logged for auditing purposes. Which solution satisfies these requirements?
- A
Use AWS Systems Manager Session Manager to establish remote sessions with EC2 instances.
- B
Enable EC2 Instance Connect and provide temporary SSH keys for access.
- C
Use an OpenVPN server running on an EC2 instance to provide secure access to the private network.
- D
Configure a bastion host for SSH access and restrict access using security group rules.
Show answer and explanation
Correct answer: A
Explanation
AWS Systems Manager Session Manager is the best solution for secure remote access to EC2 instances without requiring SSH keys. It integrates with IAM for access control and logs all session activity to CloudWatch Logs or S3 for auditing, meeting both the security and operational requirements.
- A. Correct.
This is the correct answer. AWS Systems Manager Session Manager allows secure remote access to EC2 instances without the need for SSH keys. It also provides auditing capabilities by logging all session activity to Amazon CloudWatch Logs or Amazon S3.
- B. Incorrect.
This option does not satisfy the requirement because temporary SSH keys are still used, which violates the security team's mandate of not using SSH keys.
- C. Incorrect.
While an OpenVPN server provides secure network access, it does not inherently meet the requirement for logging session activity or eliminating SSH keys.
- D. Incorrect.
A bastion host allows for SSH access but still requires SSH keys or passwords, violating the mandate. Additionally, it does not natively provide session logging for auditing purposes.