SCS-C02 Question 347
Select 3Your organization has implemented AWS Systems Manager Session Manager to securely manage EC2 instances without opening inbound ports or using SSH keys. During an audit, the security team raises concerns about ensuring that all session activity is recorded for compliance purposes. Which of the following actions should you take to address this concern?
- A
Enable session logging to an S3 bucket using AWS Systems Manager Session Manager configuration.
- B
Configure session logging to AWS CloudTrail to capture all API calls made during sessions.
- C
Enable session recording and send output to an Amazon CloudWatch Logs group.
- D
Ensure that the IAM role attached to the EC2 instances has the necessary permissions for session logging.
- E
Use AWS Key Management Service (KMS) to encrypt session logs for additional security.
Show answer and explanation
Correct answers: A, C, D
Explanation
To address the audit concern, you need to ensure that session activity is adequately logged for compliance purposes. AWS Systems Manager Session Manager provides logging capabilities to both Amazon S3 and CloudWatch Logs. Granting the appropriate IAM role permissions ensures that these logs can be created and accessed properly. While encrypting logs with KMS is a good practice for security, it is not directly related to the requirement of logging session activity. CloudTrail alone does not capture detailed session-level activity, so it is not a valid solution.
- A. Correct.
Correct. AWS Systems Manager Session Manager supports session logging to Amazon S3 for compliance and auditing purposes. Configuring this ensures that all session activity is securely logged.
- B. Incorrect.
Incorrect. While AWS CloudTrail captures API activity, it does not log the command-level activity within a Session Manager session. Specific session logging must be set up instead.
- C. Correct.
Correct. AWS Systems Manager Session Manager allows session output to be sent to Amazon CloudWatch Logs for monitoring and compliance. This is an appropriate configuration for session recording.
- D. Correct.
Correct. The IAM role attached to the EC2 instances must have the necessary permissions (e.g., ssm:StartSession, ssm:SendCommand) to enable session logging. Without these permissions, session logging will not function.
- E. Incorrect.
Incorrect. While encrypting session logs with KMS can enhance security, it is not directly required to address the audit concern of ensuring session activity is logged. This could be an additional step but is not the primary solution.