A township wants administrators to reach EC2 instances only through AWS Systems Manager Session Manager, with no inbound SSH from the internet. Which design change is required?
Select an answer to reveal the explanation.
Short Explanation
Session Manager is remote admin without punching a hole for SSH on the firewall. Drop port 22 from the security groups, keep the SSM agent healthy, and authorize operators with IAM. Wide-open SSH, public EIP farms, or emailed private keys undo the whole point.
Full Explanation
If township administrators must reach EC2 only through AWS Systems Manager Session Manager with no inbound SSH from the internet, remove inbound SSH (port 22) from instance security groups and grant Session Manager access through IAM plus healthy SSM agent prerequisites (agent installed, instance profile permissions, and connectivity to SSM endpoints). Session Manager provides interactive access without exposing SSH to the world—aligned with zero-standing-inbound-admin goals for municipal compute.
Opening port 22 to 0.0.0.0/0 and disabling the SSM agent fails because it maximizes SSH brute-force exposure and removes the preferred control channel. Placing every instance in a public subnet with an Elastic IP dedicated to SSH fails conceptually: public SSH endpoints contradict the Session Manager–only requirement. Sharing a single SSH private key by email and rotating annually fails because shared keys destroy accountability and yearly rotation is far too slow after any leak.
Exam caveat: Session Manager needs outbound HTTPS to SSM endpoints (or interface VPC endpoints) and a correct instance profile—closing port 22 without those prerequisites locks operators out. Operational check: verify SSM Online status, remove SSH ingress rules, confirm operators start sessions via IAM-authorized documents, and prove internet sources cannot connect to port 22 on the instances.