Q63 — AWS SAA-C03 Ch.13

Question 63 of 100 | ← Chapter 13

Q963. A company has applications that run in an organization in AWS Organizations.The company outsources operational support of the applications.The company needs to provide access for the external support engineers without compromising security.The external support engineers need access to the AWS Management Console.The external support engineers also need operating system access to the company's fleet of Amazon EC2 instances that run Amazon Linux in private subnets.Which solution will meet these requirements MOST securely?

• A. Confirm that AWS Systems Manager Agent(SSM Agent) is installed on all instances.Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions. ✓
• B. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use Systems Manager Session Manager to provide local IAM user credentials in each AWS account to the external support engineers for console access.
• C. Confirm that all instances have a security group that allows SSH access only from the external support engineers' source lP address ranges.Provide local IAM user credentials in each AWS account to the external support engineers for console access.Provide each external support engineer an SSH key pair to log in to the application instances.
• D. Create a bastion host in a public subnet. Set up the bastion host security group to allow access from only the external engineers'IP address ranges. Ensure that all instances have a security group that allows SSH access from the bastion host. Provide each external support engineer an SSH key pair to log in to the application instances. Provide local account IAM user credentials to the engineers for console access.

Correct Answer: A. Confirm that AWS Systems Manager Agent(SSM Agent) is installed on all instances.Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions.

Explanation

The solution that will meet these requirements MOST securely is:A. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions.Explanation:This solution leverages AWS Systems Manager Session Manager, which allows for secure, interactive shell access to EC2 instances without the need to open inbound ports or manage SSH keys. This significantly reduces the attack surface and eliminates the risk of compromised SSH keys. By using AWS IAM Identity Center (formerly AWS SSO), the company can centrally manage access to the AWS Management Console for the external support engineers, ensuring that access is granted based on the principle of least privilege.The instance profile with the necessary policy ensures that the EC2 instances have the correct permissions to interact with Systems Manager, without exposing unnecessary privileges. This solution does not require the external support engineers to have IAM user credentials in each AWS account, reducing the risk of credential misuse or compromise.The other options have significant security drawbacks:B: Providing local IAM user credentials in each AWS account to the external support engineers for console access is a security risk, as it requires managing credentials across multiple accounts.C: Allowing SSH access directly from the external support engineers' IP address ranges and providing SSH key pairs and IAM user credentials exposes the company to the risk of compromised SSH keys and credentials.D: While using a bastion host can help reduce the attack surface by limiting direct access to EC2 instances, it still requires managing SSH keys and IAM user credentials, which introduces security risks. Additionally, the bastion host itself becomes a potential point of compromise.