A CloudOps engineer created a VPC with a private subnet, a security group allowing all outbound traffic, and an endpoint for EC2 Instance Connect in the private subnet. The EC2 instance was launched…

Question

Options

• ACreate an inbound rule in the security group to allow HTTPS traffic on port 443 from the private
• BCreate an inbound rule in the security group to allow SSH traffic on port 22 from the private
• CCreate an IAM instance profile that allows AWS Systems Manager Session Manager to access
• DRecreate the EC2 instance. Associate an SSH key pair with the instance.

• A
  6% (3)
• B
  12% (6)
• C
  78% (38)
• D
  4% (2)

Explanation

According to the AWS Cloud Operations and EC2 Connectivity documentation, EC2 Instance Connect Endpoint allows access to instances without internet exposure or open SSH ports. However, for successful connectivity, the EC2 instance must have Systems Manager permissions through an IAM instance profile. If no IAM instance profile is attached, the instance cannot establish a control channel with the Systems Manager service, and EC2 Instance Connect cannot authenticate the session. Opening port 22 (Option B) is unnecessary and contradicts the private subnet design. HTTPS rules (Option A) are irrelevant because EC2 Instance Connect communicates through AWS APIs, not direct HTTPS connections. Recreating the instance with a key pair (Option D) bypasses the intended keyless connection mechanism. Therefore, Option C -- attaching an IAM instance profile with Systems Manager permissions -- enables secure, private access through EC2 Instance Connect Endpoint.

No community discussion yet for this question.