AWS Systems Manager Session Manager for EC2 Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role associated with the EC2 instances and use AWS Systems Manager Session Manager to access them.

Question

A company’s developers want a secure way to gain SSH access on the company's Amazon EC2 instances that run the latest version of Amazon Linux. The developers work remotely and in the corporate office. The company wants to use AWS services as a part of the solution. The EC2 instances are hosted in a VPC private subnet and access the internet through a NAT gateway that is deployed in a public subnet. What should a solutions architect do to meet these requirements MOST cost-effectively?
  1. Create a bastion host in the same subnet as the EC2 instances. Grant the ec2:CreateVpnConnection IAM permission to the developers. Install EC2 Instance Connect so that the developers can connect to the EC2 instances.
  2. Create an AWS Site-to-Site VPN connection between the corporate network and the VPC. Instruct the developers to use the Site-to-Site VPN connection to access the EC2 instances when the developers are on the corporate network. Instruct the developers to set up another VPN connection for access when they work remotely.
  3. Create a bastion host in the public subnet of the VPConfigure the security groups and SSH keys of the bastion host to only allow connections and SSH authentication from the developers’ corporate and remote networks. Instruct the developers to connect through the bastion host by using SSH to reach the EC2 instances.
  4. Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances. Correct Answer

Key Takeaways

The core concept tested is replacing traditional SSH with a managed service (SSM) to reduce operational overhead and security risks in private subnets.

This question evaluates the secure and cost-effective management of SSH access to private EC2 instances using AWS Systems Manager Session Manager. The page establishes that Session Manager is the preferred solution as it eliminates the need for bastion hosts, SSH keys, and inbound port exposure.

Common mistake: Candidates often choose option C (Bastion Host) because it is the traditional method for accessing private instances, failing to recognize that SSM is more cost-effective and requires less maintenance.

Expert Analysis

Why the Answer Is Correct

Option D is the correct answer because AWS Systems Manager Session Manager allows you to manage access to your instances without opening inbound ports or managing SSH keys. Since the EC2 instances are in a private subnet, they do not have public IPs. Session Manager uses an agent on the instance to establish an outbound connection to the AWS SSM service, allowing developers to connect via the console or CLI securely. This approach removes the need for a bastion host (reducing cost and maintenance), eliminates the risk of key management, and provides audit trails via CloudTrail.

Why the Other Options Are Wrong

Option A suggests creating a bastion host in the same subnet as the EC2 instances. Bastion hosts must be placed in a public subnet to receive incoming connections from the internet; placing it in a private subnet would make it unreachable. Additionally, granting ec2:CreateVpnConnection is irrelevant to SSH access. Option B proposes Site-to-Site VPNs, which are complex and expensive to maintain for simple remote access compared to SSM. It also doesn't solve the issue for developers working entirely remotely outside the corporate network easily without additional configuration like Client VPN. Option C suggests a bastion host in the public subnet. While this is a valid architectural pattern, it is less cost-effective than Option D because it requires provisioning and maintaining an extra EC2 instance, managing its OS updates, and securing SSH keys. SSM is 'serverless' in terms of infrastructure management.

Community Comment Notes

The community strongly agrees with Option D, citing it as the most secure and cost-effective method. Users note that SSM eliminates the need for SSH keys and bastion host maintenance. One user asked why C was not chosen, highlighting the common confusion between the traditional bastion host model and the modern SSM approach. Another user pointed out that Option A's suggestion to put a bastion in a private subnet is architecturally incorrect.

Exam Strategy

Always look for 'cost-effectively' and 'securely' combined. If the question involves accessing private resources without exposing them to the internet, consider AWS-native managed services like Systems Manager Session Manager over building custom infrastructure like bastion hosts.

Frequently Asked Questions

Why can't I use a bastion host in a private subnet?

A bastion host must reside in a public subnet to receive inbound traffic from the internet. Instances in a private subnet cannot accept direct inbound connections.

Is Session Manager free for EC2 instances?

There is no additional charge for the Session Manager service itself, but you pay for the underlying EC2 instance hours and data transfer costs as usual.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. alawada 👍 7 Answered D
    AWS Systems Manager Session Manager is a service that enables you to securely connect to your EC2 instances without using SSH keys or bastion hosts. You can use Session Manager to access your instances through the AWS Management Console, the AWS CLI, or the AWS SDKs. Session Manager uses IAM policies and roles to control who can access which instances. By attaching the AmazonSSMManagedlnstanceCore IAM policy to an IAM role that is associated with the EC2 instances, you grant the Session Manager service the necessary permissions to perform actions on your instances. You also need to attach another IAM policy to the developers' IAM users or roles that allows them to start sessions to the instances.
  2. Mikado211 👍 2 Answered D
    SSM is always the recommended way of connection for EC2 "using ssh". It's the most cost effective and the most secure way of doing the job.
  3. LeonSauveterre 👍 1 Answered D
    A - Bastion hosts are typically placed in public subnets (not private subnets). Also, see option C below. B - Would work, but this is too complex and too expensive. C - An additional EC2 instance (bastion host) = instance running costs + endless maintenance. D - God yes. No need to manage SSH keys, and access is encrypted by default.
  4. Andy_09 👍 5
    Option D
  5. iczcezar 👍 2
    Why not C?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide