SCS-C02 Question 346
Select 3Your company uses AWS Systems Manager Session Manager to connect securely to Amazon EC2 instances without needing to open inbound SSH ports or manage SSH keys. As part of a security audit, you are asked to ensure that all Session Manager sessions are logged for forensic and compliance purposes. Which actions should you take to meet this requirement?
- A
Enable session logging in Session Manager and configure an Amazon S3 bucket or CloudWatch Logs to store the session data.
- B
Attach an AWS Identity and Access Management (IAM) policy to the EC2 instances allowing them to write logs to Amazon S3 or CloudWatch Logs.
- C
Enable the 'LogSessionData' option in the EC2 instance metadata settings.
- D
Ensure the Systems Manager agent is installed and updated on all target EC2 instances.
- E
Configure AWS CloudTrail to capture Session Manager API calls.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure all Session Manager sessions are logged, you must enable session logging in Session Manager and specify an Amazon S3 bucket or CloudWatch Logs as the destination for logs. The EC2 instances also require IAM permissions to send these logs to the designated storage. Additionally, the Systems Manager agent must be installed and up-to-date on the instances to support Session Manager functionality. Optionally, CloudTrail can be used to track API calls, but it does not capture session details and is not a substitute for enabling session logging.
- A. Correct.
Correct: Enabling session logging in Session Manager and configuring an Amazon S3 bucket or CloudWatch Logs is required to store session data for compliance and forensic purposes.
- B. Correct.
Correct: The EC2 instances must have the appropriate IAM permissions to write session logs to Amazon S3 or CloudWatch Logs.
- C. Incorrect.
Incorrect: There is no 'LogSessionData' option in the EC2 instance metadata settings. This is a distractor and not a valid configuration step.
- D. Correct.
Correct: The Systems Manager agent must be installed and updated on target instances for Session Manager to function properly and log data.
- E. Incorrect.
Incorrect: While AWS CloudTrail can track API calls made to Session Manager, it does not capture the detailed session data itself. This is supplementary but does not fulfill the logging requirement.