Q78 — AWS SAA-C03 Ch.17

Question 78 of 89 | ← Chapter 17

Q1378. A company has deployed a non-production Amazon EC2 instance by using an Amazon Linux Amazon Machine Image (AMI) in a private subnet. The company wants to allow a group of developers to connect to the EC2 instance remotely by using SSH without exposing the EC2 instance to the internet. The developers must be able to connect to the EC2 instance through the AWS Management Console.Which solution will meet these requirements?

• A. Create a VPC endpoint for AWS Systems Manager in the same subnet as the EC2 instance. Allow inbound access from the endpoint security group to the EC2 instance security group on port 22. Create an IAM role for the EC2 instance and attach the AmazonSSMManagedInstanceCore policy.
• B. Create an EC2 Instance Connect Endpoint in the same subnet as the EC2 instance. Attach a security group to the endpoint that allows inbound connections on port 443. Assign the AmazonEC2InstanceConnect IAM managed policy to the group of developers.
• C. Create an EC2 Instance Connect Endpoint in the same subnet as the EC2 instance. Attach a security group to the endpoint that allows inbound connections on port 22. Assign the AmazonEC2InstanceConnect IAM managed policy to the group of developers. ✓
• D. Create a VPC endpoint for AWS Systems Manager in the same subnet as the EC2 instance. Allow inbound access from the endpoint security group to the EC2 instance security group on port 22. Create an IAM role for the EC2 instance and attach the AmazonSSMReadOnlyAccess policy.

Correct Answer: C. Create an EC2 Instance Connect Endpoint in the same subnet as the EC2 instance. Attach a security group to the endpoint that allows inbound connections on port 22. Assign the AmazonEC2InstanceConnect IAM managed policy to the group of developers.

Explanation

Let's analyze each option to determine which one meets the requirements of allowing developers to connect to the EC2 instance remotely via SSH without exposing it to the internet and enabling connection through the AWS Management Console:Option AVPC endpoint for AWS Systems Manager: Creating a VPC endpoint for AWS Systems Manager in the same subnet as the EC2 instance allows communication between the instance and AWS Systems Manager services without going through the internet.Security group configuration: Allowing inbound access from the endpoint security group to the EC2 instance security group on port 22 is incorrect in this context. AWS Systems Manager uses port 443 for communication, not port 22 for SSH - like access through the console. IAM role and policy: Creating an IAM role for the EC2 instance and attaching the AmazonSSMManagedInstanceCore policy enables the instance to interact with AWS Systems Manager. However, the incorrect port configuration makes this option invalid. So, this option is incorrect.Option BEC2 Instance Connect Endpoint: An EC2 Instance Connect Endpoint provides a secure way to connect to EC2 instances without exposing them to the internet. But it uses port 22 for SSH connections, not port 443. Security group configuration: Attaching a security group to the endpoint that allows inbound connections on port 443 is incorrect as it won't facilitate the SSH connection that the developers need. IAM policy assignment: Assigning the AmazonEC2InstanceConnect IAM managed policy to the group of developers allows them to use EC2 Instance Connect features, but due to the wrong port configuration, this option does not meet the requirements. So, this option is incorrect.Option CEC2 Instance Connect Endpoint: Creating an EC2 Instance Connect Endpoint in the same subnet as the EC2 instance is a valid approach. This endpoint provides a secure, private connection path for SSH access to the instance without exposing it to the internet.Security group configuration: Attaching a security group to the endpoint that allows inbound connections on port 22 enables SSH communication. This is the correct port for SSH connections. IAM policy assignment: Assigning the AmazonEC2InstanceConnect IAM managed policy to the group of developers gives them the necessary permissions to use EC2 Instance Connect to connect to the EC2 instance through the AWS Management Console. This option meets all the requirements. So, this option is correct.Option DVPC endpoint for AWS Systems Manager: Similar to Option A, creating a VPC endpoint for AWS Systems Manager in the same subnet as the EC2 instance allows private communication with AWS Systems Manager.Security group configuration: Allowing inbound access from the endpoint security group to the EC2 instance security group on port 22 is incorrect as AWS Systems Manager uses port 443. IAM role and policy: Creating an IAM role for the EC2 instance and attaching the AmazonSSMReadOnlyAccess policy is not sufficient. The instance needs the AmazonSSMManagedInstanceCore policy to fully interact with AWS Systems Manager for tasks like Session Manager (if that was the intended use, but SSH via Instance Connect is the requirement here). Also, the wrong port configuration makes this option invalid. So, this option is incorrect. Therefore, the solution that will meet the requirements is Option C.