SCS-C02 Question 344
Single answerYour organization has deployed Amazon EC2 instances in a private subnet without public IP addresses. You need to allow developers to securely access these instances for troubleshooting without opening inbound SSH ports or using a bastion host. Which AWS Systems Manager Session Manager feature or configuration is required to achieve this?
- A
Ensure the EC2 instances have the Systems Manager Agent installed and the IAM role with necessary Session Manager permissions attached.
- B
Enable SSH port forwarding in Systems Manager Session Manager to allow developers to access the instances over SSH.
- C
Configure Systems Manager Session Manager to use an S3 bucket for storing session logs.
- D
Attach an Elastic IP to the private EC2 instances for direct SSH access over the internet.
Show answer and explanation
Correct answer: A
Explanation
AWS Systems Manager Session Manager allows secure, agent-based connections to EC2 instances without needing to open inbound SSH ports or configure bastion hosts. For this to work, the EC2 instance must have the Systems Manager Agent installed and have an IAM role attached with the necessary permissions. This ensures secure and seamless access to instances in private subnets, adhering to best practices for security and access control.
- A. Correct.
Correct. For Session Manager to work, the EC2 instances must have the Systems Manager Agent installed and the associated IAM role with required permissions (e.g., 'ssm:StartSession' and 'ssm:DescribeInstanceInformation'). This enables secure, agent-based connections without opening SSH ports.
- B. Incorrect.
Incorrect. Systems Manager Session Manager does not require or depend on SSH port forwarding. It establishes a secure channel using the Systems Manager Agent and AWS service endpoints.
- C. Incorrect.
Incorrect. While storing session logs in an S3 bucket is a best practice for auditing, it is not strictly required for enabling access to private EC2 instances through Session Manager.
- D. Incorrect.
Incorrect. Attaching an Elastic IP and enabling SSH over the internet goes against the requirement of securely accessing private EC2 instances without opening inbound SSH ports.