A company has applications that run in an organization in AWS Organizations. The company outsources operational support of the applications. The company needs to provide access for the external…

Question

Options

• AConfirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an
• BConfirm that AWS Systems Manager Agent {SSM Agent) is installed on all instances. Assign an
• CConfirm that all instances have a security group that allows SSH access only from the external
• DCreate a bastion host in a public subnet. Set up the bastion host security group to allow access

• A
  78% (18)
• B
  4% (1)
• C
  13% (3)
• D
  4% (1)

Explanation

This solution provides the most secure access for external support engineers with the least exposure to potential security risks. AWS Systems Manager (SSM) and Session Manager: Systems Manager Session Manager allows secure and auditable access to EC2 instances without the need to open inbound SSH ports or manage SSH keys. This reduces the attack surface significantly. The SSM Agent must be installed and configured on all instances, and the instances must have an instance profile with the necessary IAM permissions to connect to Systems Manager. IAM Identity Center: IAM Identity Center provides centralized management of access to the AWS Management Console for external support engineers. By using IAM Identity Center, youcan control console access securely and ensure that external engineers have the appropriate permissions based on their roles. Why Not Other Options? Option B (Local IAM user credentials): This approach is less secure because it involves managing local IAM user credentials and does not leverage the centralized management and security benefits of IAM Identity Center. Option C (Security group with SSH access): Allowing SSH access opens up the infrastructure to potential security risks, even when restricted by IP addresses. It also requires managing SSH keys, which can be cumbersome and less secure. Option D (Bastion host): While a bastion host can secure SSH access, it still requires managing SSH keys and opening ports. This approach is less secure and more operationally intensive compared to using Session Manager.

No community discussion yet for this question.