A bank prohibits SSH keys and bastion hosts for 200 Linux EC2 instances in private subnets, requires MFA-backed audited shell access, and must log every command centrally. Which administrative access design meets strict no-inbound access requirements?
Select an answer to reveal the explanation.
Short Explanation
You're replacing open doors with a guarded tunnel that records everything. Session Manager gives MFA-checked shells with no inbound ports and full session logs.
Full Explanation
The correct design works because Session Manager creates an outbound-initiated browser shell via the SSM control plane, so private instances need no inbound ports, public IPs, bastions or SSH keys, while IAM MFA conditions enforce MFA-backed access and session logging to S3 and CloudWatch provides centralized audited command history scalable to 200 hosts. Using Session Manager with only IAM roles and central S3 logging fails on identity assurance because without an MFA condition it provides sound transport and auditing but does not satisfy the explicit MFA-backed requirement. Using Session Manager with MFA and local volume retention fails on centralization and durability because local logs are lost on termination, cannot be correlated for forensics, and violate the mandate to log every command centrally. Using EC2 Instance Connect Endpoint with MFA and central logging fails on prohibited protocol because although it avoids inbound rules with ephemeral keys and auditing, it still establishes SSH sessions that the bank explicitly forbids. The exam caveat is that both Session Manager and Instance Connect Endpoint support private access without inbound rules, so no-inbound alone is insufficient and MFA status, SSH use and log destination must all be verified together. The practical check is to confirm SSM Agent with VPC endpoints, enforce aws:MultiFactorAuthPresent, enable centralized S3 logging with KMS, and audit security groups for no ingress.