Q51 — AWS SAA-C03 Ch.16

Question 51 of 100 | ← Chapter 16

Q1251. A solutions architect needs to configure secure access to Amazon EC2 instances that run in private subnets in a VPC. Company policy states that the VPC must have internet access. The solution must provide company developers with the ability to log in to EC2 instances securely while complying with the company policy.Which solution will meet these requirements?

• A. Attach a virtual private gateway to the VPC.Use the virtual private gateway to create an AWS Site-to- Site VPN connection between the VPC and the company's office. Instruct developers to access the EC2 instances through the VPN tunnel by connecting to the instances' private IP addresses
• B. Enable AWS Client VPN within the VPC. Install and configure client VPN software on each developer's laptop.Instruct developers how to use the client VPN software to securely connect to the EC2 instances.
• C. Configure an Amazon EC2 VPC endpoint within the VPC. Update route tables to send all EC2 traffic through the VPC endpoint. Instruct the developers to connect to the EC2 instances through the VPC endpoint.
• D. Use VPC endpoints to implement AWS Systems Manager Session Manager within the VPC.Instruct developers to use the Session Manager console to access the EC2 instances within the VPC ✓

Correct Answer: D. Use VPC endpoints to implement AWS Systems Manager Session Manager within the VPC.Instruct developers to use the Session Manager console to access the EC2 instances within the VPC

Explanation

Best Solution: D (AWS Systems Manager Session Manager via VPC Endpoints) Why Option D is the Best ChoiceFully Compliant with Company PolicyNo direct internet access required for EC2 instances (they remain in private subnets). VPC Endpoints provide secure access to AWS Systems Manager (SSM) without exposing instances to the public internet.Session Manager uses IAM policies for authentication, eliminating the need for SSH keys or VPNs.Secure & Auditable AccessNo open SSH ports (reduces attack surface).All sessions are logged in AWS CloudTrail (compliance-friendly). Fine-grained IAM permissions control who can access which instances.Low Operational OverheadNo VPN setup/maintenance (unlike Options A & B).No VPC endpoint configuration for every service (unlike Option C, which is for AWS services, not EC2 SSH).Developers access instances via the AWS Console/CLI (no additional software needed).Why Other Options FailA. Site-to-Site VPNRequires VPN hardware/software at the office (high setup/maintenance cost). Developers need VPN client access (complex for remote teams). Still requires SSH keys (less secure than IAM-based Session Manager).B. AWS Client VPNRequires client VPN software on each developer's laptop (management overhead).Still uses SSH/RDP (less secure than Session Manager).Higher cost (per-user licensing for Client VPN).C. EC2 VPC EndpointVPC Endpoints are for AWS services (e.g., S3, DynamoDB), not for SSH access to EC2. Does not solve the secure access problem (developers still need SSH keys).How Option D WorksEnable AWS Systems Manager (SSM) on EC2 instances:Install the SSM Agent (pre-installed on Amazon Linux, Windows, and Ubuntu AMIs).Create a VPC Endpoint for SSM:Use Interface Endpoint (com.amazonaws.region.ssm) to allow private access.Set IAM permissions:Grant developers ssm:StartSession on specific EC2 instances.Developers connect via AWS Console/CLI:No SSH keys needed--just use aws ssm start-session --target .ConclusionOption D (Session Manager via VPC Endpoints) is the most secure, compliant, and low-maintenance solution.Final Answer:D