Secure administrative access (Session Manager, EC2 Instance Connect): SCS-C03 study notes and practice questions
What to know about Secure administrative access (Session Manager, EC2 Instance Connect) for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe engineers who need shell access to instances, often in private subnets, and a security rule against open inbound SSH, shared key pairs and unlogged sessions. You choose the method that authenticates each person with IAM and records what they did.
Session Manager
Session Manager opens a shell or a port-forwarding session through the SSM agent. The instance needs no inbound port open and no SSH key pair.
IAM policies decide who can start a session and on which instances. Tag conditions on the target let one policy cover a group of instances.
Session logs go to Amazon S3 or CloudWatch Logs, and you can encrypt them with a KMS key. The logs are the audit trail of commands.
The instance needs an instance profile with SSM permissions. Instances in private subnets also need the ssm, ssmmessages and ec2messages endpoints, as VPC interface endpoints or through a NAT path.
Run As starts sessions as a specific operating system user, so people do not share a root login.
EC2 Instance Connect pushes a one-time public key to the instance after an IAM check, and the key is valid only for a short time. A standard SSH client then connects on port 22, so SSH must be reachable.
EC2 Instance Connect Endpoint creates a path into a private subnet with no public IP address and no bastion host. Security group rules still control the traffic, and CloudTrail records each connection.
How to choose
Scenario wording
Pick
Engineers need shell access, every command logged, no open ports
Session Manager with logs encrypted in CloudWatch Logs
Private instances, no bastion host, an SSH client is required
EC2 Instance Connect Endpoint
Per-person SSH access with keys pushed on demand
EC2 Instance Connect
Remove shared SSH keys from a fleet
Session Manager, then remove the key pairs
Reach a private database port from a laptop
Session Manager port forwarding
Common traps
A bastion host with shared key pairs. It is a single point of compromise, and its logs show only the shared user name.
Opening port 22 to 0.0.0.0/0 for convenience.
Session Manager with logging turned off. Sessions still work, but nothing is recorded.
Missing VPC endpoints for private instances, so the SSM agent cannot register.
Confusing the two EC2 Instance Connect options. The endpoint keeps the instance private, but the key-push method still needs a reachable SSH port.
A logistics firm runs internal applications on EC2 instances in private subnets. Today, contractors reach them through a bastion host that uses shared SSH keys and an open inbound port 22. The security team wants to remove the bastion and the open port.
Each engineer must sign in with a personal identity, and every shell session must be recorded and kept for seven years in a central location. Engineers must reach only the instances tagged for their team, and access must be granted and removed from one place.
Which solution meets these requirements?
Choose one answer.
AA. Keep the bastion, replace the shared keys with one key for each engineer, and restrict port 22 on the bastion to the company office addresses, so that access is traced to each person.
BB. Use EC2 Instance Connect to push a temporary key for each SSH session, and rely on the CloudTrail records of each key push as the audit trail for later review of every engineer.
CC. Close port 22 and use Session Manager through the SSM Agent, with IAM Identity Center permission sets limited to each team's tagged instances and session logs kept in a central S3 bucket.
DD. Give each engineer a VPN into the VPC with full network access, and enable VPC flow logs on the subnets to keep a record of the sessions for later review.
Show the answer and explanation
Answer: C
A. Wrong: This keeps an inbound port and a bastion to patch, and it does not record shell sessions. Personal keys help with attribution, but the requirement to record every session is not met.
B. Wrong: Temporary keys are a good step, but CloudTrail records the key push, not the commands typed in the shell. The requirement to record and keep the session content is not met.
C. Right: Correct. Sessions go out through the agent, so no inbound port is needed, and each engineer signs in with a personal identity. The tag-based permission sets and central session logs meet the recording and access rules, and the bastion can be removed. Learn more: AWS Systems Manager Session Manager (opens in a new tab)
D. Wrong: Flow logs record connection metadata, not the content of shell sessions. Full network access also lets engineers reach every instance, which breaks the team tag limit.
Explanation
Session Manager reaches instances through the SSM Agent, so no inbound port or bastion is needed. Identity Center gives each engineer a personal sign-in, tag-based permissions limit the instances, and session logs are kept centrally. Shared or per-engineer keys, temporary keys and flow logs each miss a stated requirement.
Want more on Secure administrative access (Session Manager, EC2 Instance Connect)? The 5 full-length practice sets have 5 more Secure administrative access (Session Manager, EC2 Instance Connect) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Secure administrative access (Session Manager, EC2 Instance Connect)