Secure SSH Access to Private EC2 Instances
A company launches an application. The company hosts the application on Amazon EC2 instances. The instances are in a private subnet for security reasons. An application team needs SSH access to the instances from corporate desktops in an office. The desktops are connected to the internet. Which solution will provide this access?
Community Insight
The question tests knowledge of connectivity options for private subnets. The common trap is assuming public-facing components like NAT gateways or Internet Gateways can facilitate inbound management traffic from the internet.
This question addresses secure remote access to resources in a private subnet. The correct solution involves establishing a trusted encrypted tunnel between the corporate network and the VPC.
Candidates often select Option C (Internet Gateway) because they associate it with internet access, failing to realize that an IGW allows outbound traffic but does not provide a mechanism for initiating secure inbound SSH sessions from specific corporate IPs to private instances without additional complex routing and security group configurations that are not standard for this scenario.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B. An AWS Site-to-Site VPN creates an encrypted tunnel between your on-premises corporate network and the AWS VPC. This allows users on corporate desktops to securely connect to the private subnet instances via SSH as if they were locally connected, without exposing the instances to the public internet.Why the Other Options Are Wrong
Option A (NAT Gateway) allows instances in the private subnet to initiate outbound connections to the internet; it does not allow inbound connections from the internet to the instances. Option C (Internet Gateway) enables instances in public subnets to communicate with the internet but does not inherently provide secure inbound access to private subnets. Option D suggests allowing inbound traffic from on-premises to public subnets, but the question specifies the instances are in a private subnet, so this option misidentifies the target resource location and lacks the encryption/security best practices of a VPN.Community Comment Notes
As Bad_Mat noted, "The correct solution is B," highlighting the consensus among experienced candidates that a VPN is the standard approach for this requirement. The comment reinforces that direct internet exposure is incorrect for private subnet management.Exam Strategy
When asked about accessing private resources from on-premises, always look for Site-to-Site VPN or Direct Connect first. Avoid options that expose private subnets directly to the internet unless specifically asked for public accessibility.
Frequently Asked Questions
Why can't I use an Internet Gateway for SSH?
An Internet Gateway allows instances to reach the internet but does not support inbound SSH initiation to private subnets securely.
Is NAT Gateway suitable for inbound management?
No, NAT Gateways only support outbound internet traffic from private subnets, not inbound connections.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →