Secure SSH Access to Private EC2 Instances
Short answer
B Create an AWS Site-to-Site VPN connection between the on-premises network and the VPC.
Question
An application team needs SSH access to the instances from corporate desktops in an office. The desktops are connected to the internet.
Which solution will provide this access?
Key Takeaways
The question tests knowledge of connectivity options for private subnets. The common trap is assuming public-facing components like NAT gateways or Internet Gateways can facilitate inbound management traffic from the internet.
This question addresses secure remote access to resources in a private subnet. The correct solution involves establishing a trusted encrypted tunnel between the corporate network and the VPC.
Common mistake: Candidates often select Option C (Internet Gateway) because they associate it with internet access, failing to realize that an IGW allows outbound traffic but does not provide a mechanism for initiating secure inbound SSH sessions from specific corporate IPs to private instances without additional complex routing and security group configurations that are not standard for this scenario.
Expert Analysis
Why the Answer Is Correct
The correct answer is B. An AWS Site-to-Site VPN creates an encrypted tunnel between your on-premises corporate network and the AWS VPC. This allows users on corporate desktops to securely connect to the private subnet instances via SSH as if they were locally connected, without exposing the instances to the public internet.
Why the Other Options Are Wrong
Option A (NAT Gateway) allows instances in the private subnet to initiate outbound connections to the internet; it does not allow inbound connections from the internet to the instances. Option C (Internet Gateway) enables instances in public subnets to communicate with the internet but does not inherently provide secure inbound access to private subnets. Option D suggests allowing inbound traffic from on-premises to public subnets, but the question specifies the instances are in a private subnet, so this option misidentifies the target resource location and lacks the encryption/security best practices of a VPN.
Community Comment Notes
As Bad_Mat noted, "The correct solution is B," highlighting the consensus among experienced candidates that a VPN is the standard approach for this requirement. The comment reinforces that direct internet exposure is incorrect for private subnet management.
Exam Strategy
When asked about accessing private resources from on-premises, always look for Site-to-Site VPN or Direct Connect first. Avoid options that expose private subnets directly to the internet unless specifically asked for public accessibility.
Frequently Asked Questions
Why can't I use an Internet Gateway for SSH?
Is NAT Gateway suitable for inbound management?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Bad_Mat 👍 1 Answered BThe correct solution is B. Create an AWS Site-to-Site VPN connection between the on-premises network and the VPC
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →