Q16 — AWS SAA-C03 Ch.12

Question 16 of 100 | ← Chapter 12

Q816. A company developers want a secure way to gain SSH access on the company's Amazon EC2 instances that run the latest version of Amazon Linux. The developers work remotely and in the corporate office.The company wants to use AWS services as a part of the solution. The EC2 instances are hosted in a VPC private subnet and access the internet through a NAT gateway that is deployed in a public subnet.What should a solutions architect do to meet these requirements MOST cost-effectively?

• A. Create a bastion host in the same subnet as the EC2 instances. Grant the ec2:CreateVpnConnection IAM permission to the developers. Install EC2 Instance Connect so that the developers can connect to the EC2 instances.
• B. Create an AWS Site-to-Site VPN connection between the corporate network and the VPC. Instruct the developers to use the Site-to-Site VPN connection to access the EC2 instances when the developers are on the corporate network. Instruct the developers to set up another VPN connection for access when they work remotely.
• C. Create a bastion host in the public subnet of the VPConfigure the security groups and SSH keys of the bastion host to only allow connections and SSH authentication from the developers?corporate and remote networks. Instruct the developers to connect through the bastion host by using SSH to reach the EC2 instances.
• D. Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances. ✓

Correct Answer: D. Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances.

Explanation

AWS Systems Manager Session Manager provides secure and auditable instance management without the need for SSH keys or open inbound ports. It allows you to establish a secure shell (SSH) connection to your EC2 instances directly from the AWS Management Console, CLI, or SDKs.By attaching the AmazonSSMManagedInstanceCore IAM policy to the EC2 instances, you provide the necessary permissions for the instances to be managed by Systems Manager.This solution eliminates the need for a bastion host, VPN connections, or additional networking components. It leverages the native AWS Systems Manager service to provide secure remote access to the EC2 instances, making it a cost-effective and efficient solution.