How to Provide SSH Access to a Private EC2 Instance Without Internet Exposure?

SOA-C03 By islever Editorial Last updated

Implement and optimize networking features and connectivity. Implement strategies to protect data and infrastructure.

Short answer

A Create an EC2 Instance Connect endpoint in the private subnet and grant administrators scoped tunnel-opening permissions so SSH works without internet exposure.

Question

A company has a VPC that contains a public subnet and a private subnet. The company deploys an Amazon EC2 instance that uses an Amazon Linux Amazon Machine Image (AMI) and has the AWS Systems Manager Agent (SSM Agent) installed in the private subnet. The EC2 instance is in a security group that allows only outbound traffic.
A CloudOps engineer needs to give a group of privileged administrators the ability to connect to the instance through SSH without exposing the instance to the internet.
Which solution will meet this requirement?
  1. Create an EC2 Instance Connect endpoint in the private subnet. Update the security group to allow inbound SSH traffic. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group. Correct Answer
  2. Create a Systems Manager endpoint in the private subnet. Update the security group to allow SSH traffic from the private network where the Systems Manager endpoint is connected. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
  3. Create an EC2 Instance Connect endpoint in the public subnet. Update the security group to allow SSH traffic from the private network. Create an IAM group for privileged administrators. Assign the PowerUserAccess managed policy to the IAM group.
  4. Create a Systems Manager endpoint in the public subnet. Create an IAM role that has the AmazonSSMManagedInstanceCore permission for the EC2 instance. Create an IAM group for privileged administrators. Assign the AmazonEC2ReadOnlyAccess IAM policy to the IAM group.

Key Takeaways

It tests private-subnet SSH connectivity via an EC2 Instance Connect Endpoint; the trap is assuming the installed SSM Agent automatically makes a Systems Manager endpoint an SSH solution.

This question tests how to provide SSH access to a private EC2 instance without an internet gateway by using an EC2 Instance Connect endpoint. The page establishes that the endpoint must be created in the private subnet and that administrators need the right IAM permissions, making option A correct.

Common mistake: Many candidates choose B because the SSM Agent is present, but a Systems Manager endpoint alone is not an SSH gateway and the option omits the instance role required for Session Manager.

Expert Analysis

Why the Answer Is Correct

Option A is correct because an EC2 Instance Connect Endpoint is purpose-built to reach instances in private subnets without a public IP, internet gateway, or bastion host. The endpoint must be placed in the private subnet, and the instance security group must allow inbound SSH from the endpoint's security group so the tunnel can reach port 22. Administrators also need IAM permission to open the tunnel, and PowerUserAccess is broad but includes the relevant EC2 Instance Connect actions. The instance stays private because the SSH path is through the endpoint, not the internet.

Why the Other Options Are Wrong

Option B fails because a Systems Manager endpoint is for SSM Agent control-plane traffic, not a general SSH gateway; Session Manager also does not require opening inbound SSH from the private network. The option omits the instance IAM role that would be needed for SSM registration, such as AmazonSSMManagedInstanceCore. Option C places the EC2 Instance Connect endpoint in the public subnet and uses a vague private-network SSH source, which does not match the endpoint security group pattern. Option D gets the instance role right but puts the SSM endpoint in the public subnet and gives administrators only AmazonEC2ReadOnlyAccess, which cannot start a session or open a tunnel.

Community Comment Notes

Commenter emupsx1 selected A and observed that option D 'must be modified to' add SSM VPC endpoints and an instance role, which correctly spots D's missing instance-side pieces. Commenter Bad_Mat argued 'The correct choice is B' by describing an SSM endpoint as the SSH path, but that explanation does not resolve the absent instance profile or the unnecessary inbound SSH rule. The split highlights the intended distractor: the SSM Agent in the prompt makes Systems Manager feel relevant, while the explicit SSH requirement points to EC2 Instance Connect Endpoint.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the access method literally: if the requirement says SSH and no internet exposure, look for EC2 Instance Connect Endpoint in the private subnet, not SSM Session Manager. Verify each option supplies both the administrator-side permissions and the correct endpoint placement before choosing.

Frequently Asked Questions

Why is option B wrong when the EC2 instance already has the SSM Agent installed?

SSM Agent enables Session Manager only with an instance profile and private SSM endpoints; option B omits the role and opens inbound SSH unnecessarily.

Does the EC2 Instance Connect endpoint need to be in the private subnet?

Yes for this design: placing it in the private subnet lets administrators reach the private instance through the endpoint without an internet gateway or public IP.

More SOA-C03 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. emupsx1 👍 2 Answered A
    The correct answer is A. Option D is incorrect. To make it a valid solution, it must be modified to the following: "Create Systems Manager VPC endpoints in the private subnet. Create an IAM role that has the AmazonSSMManagedInstanceCore permission and attach it to the EC2 instance. Create an IAM group for privileged administrators. Assign an IAM policy that allows the ssm:StartSession action to the IAM group."
  2. Bad_Mat 👍 1 Answered B
    The correct choice is B.To connect to an EC2 instance in a private subnet using Systems Manager without an internet gateway or public exposure, you create a Systems Manager (SSM) VPC endpoint in the private subnet, configure security groups to allow traffic from the private network, and grant the appropriate permissions (PowerUserAccess) to the privileged administrator IAM group.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide