Q41 — AWS SAA-C03 Ch.16

Question 41 of 100 | ← Chapter 16

Q1241. A cloud engineer wants to use AWS Systems Manager Session Manager to access an Amazon EC2 instance. The EC2 instance runs in a private VPC that does not have an internet gateway.Which solution will meet these requirements?

Correct Answer: D. Create an lAM role that grants Amazon EC2 permission to access Systems Manager. Associate the lAM role with the EC2 instance profile of the EC2 instance.

Explanation

The cloud engineer wants to use AWS Systems Manager Session Manager to access an Amazon EC2 instance in a private VPC without an internet gateway. Session Manager allows secure, SSH-like access to EC2 instances without requiring bastion hosts or open SSH ports.Key Requirements:No internet gateway The instance cannot communicate directly with AWS services over the public internet.Session Manager must work The instance must have a way to communicate with the AWS Systems Manager service.How Session Manager Works:Session Manager relies on the AWS Systems Manager (SSM) Agent running on the EC2 instance. The SSM Agent communicates with the AWS Systems Manager service via:Public endpoints (if the instance has internet access via an IGW or NAT gateway). VPC endpoints (if the instance is in a private subnet and uses a PrivateLink interface endpoint for SSM). IAM permissions are required for the EC2 instance to interact with SSM.Analysis of Options:A. Generate a new EC2 key pair. Stop the EC2 instance and assign the new key to the instance. Relaunch the EC2 instance.Incorrect: Session Manager does not require SSH keys. It uses IAM roles and SSM Agent for access. This solution is irrelevant.B. Move the EC2 instance to a public subnet.Incorrect: While this would allow internet access (if an IGW is attached), it violates the requirement of keeping the instance in a private VPC without an IGW. Additionally, Session Manager can work without exposing the instance to the public internet if a VPC endpoint is used. C. Create an inbound rule in the security group that is assigned to the EC2 instance. Configure the inbound rule to allow Session Manager to connect to the EC2 instance. Incorrect: Session Manager does not require inbound rules in the security group because it uses outbound communication from the SSM Agent to AWS services (via VPC endpoints or public internet). This step is unnecessary.D. Create an IAM role that grants Amazon EC2 permission to access Systems Manager. Associate the IAM role with the EC2 instance profile of the EC2 instance.Correct:Session Manager requires the SSM Agent to have IAM permissions to interact with AWS Systems Manager.The EC2 instance must be assigned an IAM role with the AmazonSSMManagedInstanceCore policy (or equivalent permissions).Since the VPC has no internet gateway, the instance must use a VPC interface endpoint for SSM (e.g., com.amazonaws.region.ssm). However, the question does not mention configuring a VPC endpoint, but IAM permissions are still required for Session Manager to work (even if communication happens via a VPC endpoint).This is the most fundamental requirement for Session Manager to function.Missing Piece (But Still the Best Answer):The question does not mention configuring a VPC endpoint for SSM, but since the VPC has no internet gateway, the engineer would also need to set up a VPC interface endpoint for SSM to allow communication without internet access.However, among the given options, only D is strictly required for Session Manager to work (even if additional steps like VPC endpoints are needed for full connectivity in a private subnet).Final Answer:D. Create an IAM role that grants Amazon EC2 permission to access Systems Manager. Associate the IAM role with the EC2 instance profile of the EC2 instance.Additional Recommendation:To fully enable Session Manager in a private subnet without an IGW, the engineer should also:Create a VPC interface endpoint for com.amazonaws.region.ssm (and optionally com.amazonaws.region.ec2messages and com.amazonaws.region.ssmmessages). Ensure the SSM Agent is installed and running on the EC2 instance (it is installed by default on Amazon Linux 2, Ubuntu, and Windows AMIs).