SCS-C02 Question 342
Single answerAn organization wants to provide secure remote access for their administrators to manage Amazon EC2 instances. They currently use SSH for access but are concerned about managing SSH keys and the risks of exposing ports to the internet. Which of the following solutions would address these concerns?
- A
Use Systems Manager Session Manager to connect to the EC2 instances without requiring SSH keys or open ports.
- B
Deploy a bastion host in a public subnet to act as a secure entry point for SSH access to the EC2 instances.
- C
Use AWS Client VPN to securely connect to the VPC, then access the EC2 instances using SSH.
- D
Enable EC2 Instance Connect to allow browser-based SSH access to the instances.
Show answer and explanation
Correct answer: A
Explanation
Systems Manager Session Manager is the best solution for secure remote access in this scenario. It eliminates the need for SSH keys and open ports, addressing the organization's concerns about security and operational overhead. Access is managed using IAM policies, making it highly secure and auditable, while also reducing the attack surface of the EC2 instances.
- A. Correct.
This is the correct answer. Systems Manager Session Manager provides secure remote access to EC2 instances without requiring SSH keys or the need to open any inbound ports to the instances. Access can be managed through IAM policies, making it more secure and easier to audit.
- B. Incorrect.
While a bastion host provides a centralized point for SSH access, it still requires managing SSH keys and exposing the bastion host's port to the internet, which doesn't fully address the organization's concerns.
- C. Incorrect.
AWS Client VPN allows for secure connectivity to the VPC, but it still requires SSH keys and open ports to access EC2 instances, which doesn't eliminate the concerns raised in the scenario.
- D. Incorrect.
EC2 Instance Connect offers browser-based SSH access without requiring SSH key management, but it still requires exposing the SSH port (22) on the instances, which doesn't meet the organization's goal of avoiding open ports.