These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-036
Operators need shell access to EC2 instances in a private subnet. Which configuration is the most appropriate for doing so without running a bastion server, without opening any inbound ports on the instances, and while being able to audit who connected and when?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. Use AWS Systems Manager Session Manager, making sure the SSM Agent can reach the required endpoints to establish a session
Explanation
Session Manager establishes a session using an outbound connection from the SSM Agent on the instance to Systems Manager. No inbound port and no bastion is needed, connections are controlled by IAM, and operations can be audited through CloudTrail and session logs.
Per-choice explanations
A. Place a bastion EC2 instance in a public subnet and allow port 22 only from the operators' source IP addresses
Incorrect. The operational burden of patching, key management, and availability for the bastion server itself remains, and inbound port 22 stays open. It does not meet the requirements of "no bastion to operate" and "no inbound ports opened."
B. Assign an Elastic IP to the target instance, change the SSH listening port from 22, and connect with a key pair
Incorrect. This exposes an instance in a private subnet to the internet, which is the opposite of the requirement. Changing the port number does not remove the listener, so it is not a meaningful security improvement either.
C. Use AWS Systems Manager Session Manager, making sure the SSM Agent can reach the required endpoints to establish a session
Correct. Because the session is established with an outbound connection only, you can operate with the security group's inbound rules left empty.
D. Enable EC2 Instance Connect and connect over SSH from the browser in the Management Console
Incorrect. Connecting from the console with EC2 Instance Connect requires the instance to allow inbound port 22 from the EC2 Instance Connect service prefix list and to be reachable. That conflicts with the requirement to open no inbound ports at all.
Practical Use
AWS Systems Manager Session Manager lets you open a shell session to EC2 instances and on-premises servers from a browser or the AWS CLI. The key to how it works is the direction of communication: the SSM Agent running on the instance connects outbound to the Systems Manager endpoints, and the session rides on that path. Therefore you can connect without writing a single inbound rule in the instance's security group, and neither a bastion server nor a key pair is required. Whether a connection is allowed is controlled by IAM policies (such as ssm:StartSession), and who connected to which instance and when is recorded in CloudTrail. As design prerequisites, the instance needs an IAM instance profile that includes AmazonSSMManagedInstanceCore, and it needs a path to reach the SSM endpoints. In a private subnet there are two ways to build that path. One is to go out to the internet through a NAT Gateway; the other is to create three interface VPC endpoints for ssm, ssmmessages, and ec2messages so that traffic reaches Systems Manager without leaving for the internet. The latter avoids the fixed cost of a NAT Gateway and keeps traffic inside the AWS network. Session content can be recorded to S3 or CloudWatch Logs, and sessions can be encrypted with KMS. On SAA-C03, requirements such as "eliminate the bastion server," "do not open the SSH port," "do not manage key pairs," and "audit connections" point to Session Manager. Distractors include building a bastion EC2 instance, changing the SSH port number, and assigning a public IP, all traditional designs. In the context of avoiding a NAT Gateway in a private subnet, questions sometimes go as far as the three VPC endpoints.