A township wants administrators to reach EC2 instances only through AWS Systems Manager Session Manager, with no inbound SSH from the internet. Which design change is required?
Select an answer to reveal the explanation.
Short Explanation
Session Manager is remote admin without punching a hole for SSH on the firewall. Drop port 22 from the security groups, keep the SSM agent healthy, and authorize operators with IAM. Wide-open SSH, public EIP farms, or emailed private keys undo the whole point.
Full Explanation
AWS Systems Manager Session Manager provides interactive shell and port-forwarding style access to EC2 without inbound SSH rules when instances meet agent, networking (to SSM endpoints), and IAM requirements. Closing port 22 to the internet reduces the attack surface compared with bastion-less public SSH. Opening 22 widely, relying solely on public EIPs for SSH, or distributing long-lived SSH keys in email conflicts with the township’s Session Manager-only policy.