A county operations team still bastions into EC2 with long-lived SSH keys and shared jump hosts, and auditors want session logging without opening inbound SSH. Which continuous-improvement change best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Think of SSH keys like spare house keys floating around the county—Session Manager is the badge reader that logs who walked in. Operators authenticate with IAM, no inbound 22, and sessions can land in CloudWatch or S3 for the auditors. That is how you retire snowflake bastions without giving up ops access.
Full Explanation
AWS Systems Manager Session Manager improves operational access by removing the need for inbound SSH, long-lived host keys, and shared bastion snowflakes. Access is authorized through IAM, and session activity can be logged to CloudWatch Logs or S3 for audit. Weekly key rotation in shared storage and broad SSH exposure still leave credential sprawl and weak evidence trails. For Domain 3 operational excellence on existing fleets, Session Manager is the managed pattern that both hardens access and improves traceability.