Operate an EC2 instance in a private subnet.
Avoid a bastion host and inbound SSH while auditing administrative sessions.
Which feature is most appropriate?
Use Systems Manager Session Manager for an IAM-controlled session through the SSM Agent.
Detailed explanation
A DNS name does not provide a network path, authentication, or audit controls.
A DNS name does not provide a network path, authentication, or audit controls.
Storing the key there increases the risk of credential exposure.
Storing the key there increases the risk of credential exposure.
This exposes the management port to the internet.
This exposes the management port to the internet.
Session Manager establishes an audited shell through the agent without an inbound SSH port.
Session Manager establishes an audited shell through the agent without an inbound SSH port.
Check official documentation
Compare the following points with the official documentation.
AWS Systems Manager Session Managerの公式説明を確認する。
What to confirm
SSH踏み台とSession Managerの管理経路を比較できる。
Key points
- Session Manager
- SSM Agent
- SSH port
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Private administration
Session Manager can operate without an inbound SSH route or bastion host.
Audited access
IAM and session logging provide a controllable administrative trail.