How to Provide Keyless SSH Access to EC2 and On-Premises Servers?

SCS-C03 By islever Editorial Last updated Oct 18, 2026

Design and implement security controls for compute workloads. Design and implement network security controls.

Short answer

B AWS Systems Manager Session Manager provides temporary, keyless shell access to EC2 and on-premises servers without opening inbound SSH ports.

Question

A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?

Create a bastion host with port forwarding to connect to the machines.
Set up AWS Systems Manager Session Manager to allow temporary connections. Correct Answer
Use AWS CloudShell to create serverless connections.
Set up an interface VPC endpoint for each machine for private connection.

Key Takeaways

The question tests keyless remote administration across hybrid machines while keeping them network-isolated outside sessions; the trap is assuming a bastion host or VPC endpoint removes SSH key management.

AWS Systems Manager Session Manager provides keyless, temporary shell access to EC2 instances and on-premises servers without opening inbound SSH ports, satisfying the isolation and no-SSH-key requirements.

Common mistake: Choosing a bastion host because it is the traditional SSH jump path, but a bastion still requires SSH key distribution, inbound SSH rules, and a permanently reachable host.

Expert Analysis

Why the Answer Is Correct

AWS Systems Manager Session Manager uses the SSM Agent to initiate outbound connections to the Systems Manager service, so the EC2 instances and on-premises servers need no inbound SSH port or public IP. It supports both Amazon EC2 instances and on-premises servers through managed-instance activation, and access is controlled by IAM rather than SSH key pairs. Sessions are opened only when needed and can be logged to CloudWatch Logs or S3, which fits the requirement to keep machines isolated outside maintenance windows. Session Manager also has no separate per-session charge, so the company avoids a permanent bastion host and pays for underlying compute usage instead.

Why the Other Options Are Wrong

A bastion host with port forwarding still requires SSH key distribution, a permanently reachable inbound SSH path, and separate connectivity for on-premises servers. CloudShell is a browser-based administrative shell in an AWS account, not a connection broker for arbitrary EC2 or on-premises machines, and it does not eliminate SSH keys. An interface VPC endpoint is a VPC networking construct attached to a service, not to each machine, and it does not provide interactive shell access or keyless authentication for on-premises servers. Port forwarding through a bastion also adds an always-on host that conflicts with the requirement to isolate machines outside maintenance windows.

Community Comment Notes

bigdata2ml highlighted that Session Manager covers Amazon EC2 instances, edge devices, on-premises servers, and VMs, which maps to the hybrid scope here. 7f6aef3 summarized that it meets the three requirements, including no SSH keys, isolation when no session is active, and both EC2 and on-premises support. d3717d5 noted that it "is a standard now to use SSM instead of SSH," while J-Babe focused on the fact that it "doesn’t require SSH keys."

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Focus on the distinguishing requirements: no SSH keys, no inbound ports, hybrid EC2 and on-premises support, and temporary sessions point directly to Session Manager. Eliminate bastion and endpoint options as soon as key management or persistent network exposure appears.

Frequently Asked Questions

Why is a bastion host wrong when Session Manager is available?

A bastion still needs SSH keys, an always-on inbound SSH path, and separate access for on-premises servers, so it conflicts with the no-key and isolation requirements.

Does Session Manager work for on-premises servers in this scenario?

Yes. The SSM Agent can be activated on on-premises servers as a managed instance, allowing IAM-controlled sessions without inbound ports or SSH keys.

More SCS-C03 FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

bigdata2ml 👍 2 Answered B

Session Manager is a fully managed AWS Systems Manager tool. With Session Manager, you can manage your Amazon Elastic Compute Cloud (Amazon EC2) instances, edge devices, on-premises servers, and virtual machines (VMs). You can use either an interactive one-click browser-based shell or the AWS Command Line Interface (AWS CLI). Session Manager provides secure node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys.
7f6aef3 👍 1 Answered B

Cumple los tres requisitos: sin llaves SSH, aislamiento cuando no hay sesión activa, funciona tanto en EC2 como on-premises, y sin infraestructura permanente que mantener.
J-Babe 👍 1 Answered B

The answer is B cuz they don’t want to manage SSH keys and system manager doesn’t require SSH keys which meets the customer requirements.
d3717d5 👍 1 Answered B

it is a standard now to use SSM instead of SSH.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide