A CloudOps engineer needs to control access to groups of Amazon EC2 instances using AWS Systems Manager Session Manager. Specific tags on the EC2 instances have already been added. Which additional…

Question

Options

• AAttach an IAM policy to the users or groups that require access to the EC2 instances.
• BAttach an IAM role to control access to the EC2 instances.
• CCreate a placement group for the EC2 instances and add a specific tag.
• DCreate a service account and attach it to the EC2 instances that need to be controlled.
• ECreate an IAM policy that grants access to any EC2 instances with a tag specified in the

• A
  76% (19)
• B
  4% (1)
• C
  4% (1)
• D
  16% (4)

Explanation

AWS Systems Manager Session Manager allows secure, auditable instance access without SSH keys or inbound ports. To control access based on instance tags, CloudOps best practices require two configurations: Attach an IAM policy to users or groups granting ssm:StartSession, ssm:DescribeInstanceInformation, and ssm:DescribeSessions. Include a Condition element in the IAM policy referencing instance tags, such as Condition: {"StringEquals": {"ssm:resourceTag/Environment": "Production"}}. This ensures users can start sessions only with instances that have matching tags, providing fine- grained access control. AWS CloudOps documentation under Security and Compliance states: "Use IAM policies with resource tags in the Condition element to restrict which managed instances users can access using Session Manager." Options B and D incorrectly suggest attaching roles or service accounts that are not relevant to user-level access control. Option C (placement groups) pertains to networking and performance, not access management. Therefore, A and E together provide tag-based, least-privilege access

No community discussion yet for this question.