Secure External Access to EC2 via Systems Manager

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Use AWS IAM Identity Center for console access and Systems Manager Session Manager for secure OS-level access to private instances without opening SSH ports.

Question

A company has applications that run in an organization in AWS Organizations. The company outsources operational support of the applications. The company needs to provide access for the external support engineers without compromising security. The external support engineers need access to the AWS Management Console. The external support engineers also need operating system access to the company’s fleet ofAmazon EC2 instances that run Amazon Linux in private subnets. Which solution will meet these requirements MOST securely?
  1. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions. Correct Answer
  2. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use Systems Manager Session Manager to provide local IAM user credentials in each AWS account to the external support engineers for console access.
  3. Confirm that all instances have a security group that allows SSH access only from the external support engineers’ source IP address ranges. Provide local IAM user credentials in each AWS account to the external support engineers for console access. Provide each external support engineer an SSH key pair to log in to the application instances.
  4. Create a bastion host in a public subnet. Set up the bastion host security group to allow access from only the external engineers’ IP address ranges. Ensure that all instances have a security group that allows SSH access from the bastion host. Provide each external support engineer an SSH key pair to log in to the application instances. Provide local account IAM user credentials to the engineers for console access.

Key Takeaways

The core test is securing access without opening network ports; the trap involves choosing options that rely on insecure practices like managing local IAM user credentials or exposing SSH keys through bastion hosts.

This question explores the most secure method for granting external support engineers console and OS-level access to private Amazon Linux instances, highlighting the superiority of AWS IAM Identity Center and Systems Manager Session Manager over traditional SSH and local credentials.

Common mistake: Candidates often choose Option D (Bastion Host) because it is a common architectural pattern, failing to recognize that managing SSH keys and local IAM users across multiple accounts creates significant security overhead and risk compared to managed identity solutions.

Expert Analysis

Why the Answer Is Correct

Option A is the correct answer because it leverages two AWS best practices for secure remote access: AWS IAM Identity Center for centralized, federated console access, and Systems Manager Session Manager for OS-level access. Session Manager allows agents in private subnets to initiate outbound connections to AWS, eliminating the need to open inbound SSH ports (port 22) or manage SSH key pairs. This significantly reduces the attack surface and provides detailed logging of all sessions.

Why the Other Options Are Wrong

Option B suggests providing "local IAM user credentials" for console access. Managing long-term access keys or passwords for individual users across an organization is less secure and harder to audit than using IAM Identity Center with SAML/SSO. Furthermore, Session Manager does not provide IAM user credentials; it provides session access via the agent. Option C proposes allowing SSH from specific IP ranges. While restricting IPs is good practice, it still requires managing SSH keys and exposes instances to potential brute-force attacks if IPs are spoofed or compromised. It lacks the centralized auditing and no-port-open security of Session Manager. Option D introduces a Bastion Host. While better than direct SSH, it adds complexity, requires maintaining the bastion instance, and still relies on SSH keys and local IAM user credentials, which are less secure and scalable than the solution in Option A.

Community Comment Notes

The community overwhelmingly supports Option A. As 'officedepotadmin' noted, "Systems Manager Session Manager allows secure, auditable, and controlled access... without needing to open SSH ports." Another commenter, 'Changwha', emphasized that this approach "minimizes the attack surface by eliminating the need for SSH access." Users correctly identified that managing local IAM credentials (Options B, C, D) is a security anti-pattern in modern AWS architectures.

Exam Strategy

When asked for the "MOST securely" option involving private instances, look for solutions that avoid opening inbound ports (like SSH/RDP). Prefer managed services like Systems Manager Session Manager and IAM Identity Center over manual credential management or bastion hosts unless specific legacy constraints exist.

Frequently Asked Questions

Why is Session Manager better than SSH for private subnets?

Session Manager initiates outbound connections, so you don't need to open inbound port 22. It also provides encrypted sessions and detailed CloudTrail logs without managing SSH keys.

Can I use Session Manager without installing the SSM Agent?

No, the SSM Agent must be installed and running on the EC2 instance to establish the secure channel with the AWS Systems Manager service.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. officedepotadmin 👍 3 Answered A
    Systems Manager Session Manager allows secure, auditable, and controlled access to your EC2 instances without needing to open SSH ports or manage SSH keys, reducing the attack surface. Local IAM user credentials are less secure and harder to manage at scale compared to using IAM Identity Center.
  2. Changwha 👍 2
    A: This solution minimizes the attack surface by eliminating the need for SSH access, avoids bastion hosts, and provides secure, auditable, and federated access to AWS resources.
  3. Cpso 👍 2 Answered A
    A or B. Exam not tell if they have IDP and no. of outsource.
  4. LeonSauveterre 👍 1 Answered A
    A - It leverages AWS-managed solutions that simplify operations, enhance security, and meet the requirement for both console and OS-level access, while avoiding the pitfalls of SSH-based access or local user management, so this is what we're looking for. B - Providing local IAM user credentials increases operational overhead and security risks. Managing these credentials across multiple AWS accounts can lead to inconsistency and potential vulnerabilities. C - Allowing SSH access via security groups and distributing SSH key pairs introduces significant security risks. Keys could be lost or misused, and managing IP address ranges is not a piece of cake. D - Bastion hosts require ongoing maintenance and monitoring to ensure security, which is unnecessary with Session Manager.
  5. EllenLiu 👍 1 Answered A
    B: I believe the Session Manager may not have the capability to provide IAM user credentials. If it were to do so, it could potentially lead to security concerns.
Show 1 more comment
  1. swati1508 👍 2
    A use MSM

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide