A company wants to remove all SSH keys permanently from a specific subset of its Amazon Linux 2 Amazon EC2 instances that are using the same IAM instance profile. However, three individuals who have I

Question

Options

• AAssign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS
• BAssign an IAM policy to the IAM user accounts to provide permission to use AWS Systems
• CAssign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS
• DAssign an IAM policy to the IAM user accounts to provide permission to use the EC2 service in

• A
  13% (2)
• C
  81% (13)
• D
  6% (1)

Explanation

Option C is correct because AWS Systems Manager (SSM) Session Manager enables keyless SSH-like access, but it requires a two-sided policy setup: the EC2 instance profile must have the AmazonSSMManagedInstanceCore policy so SSM can manage the instance, AND the IAM users must have ssm:StartSession (and related) permissions to initiate sessions - C is the only option that addresses both sides simultaneously.

Option A fails because it only grants the instance profile SSM access without giving the three IAM users permission to actually start sessions. Option B fails for the opposite reason - granting users SSM permissions without the instance profile policy means SSM cannot communicate with the instances at all. Option D is a distractor that grants EC2 console access, which has nothing to do with enabling keyless SSH; direct EC2 access still requires SSH keys.

Memory tip: Think of SSM Session Manager as a door with two locks - the instance profile is the key on the server side (lets SSM in), and the IAM user policy is the key on the user side (lets users connect). You must unlock both, which is exactly what C does.

No community discussion yet for this question.