[Monitoring, Reporting, and Automation] A team of On-call engineers frequently needs to connect to Amazon EC2 Instances In a private subnet to…

Step-by-Step

Understand the Problem:

Engineers need to connect to EC2 instances in a private subnet for troubleshooting.

The instances are using Windows or Amazon Linux AMIs.

The team already has an IAM role for authorization.

Analyze the Requirements:

Provide secure and efficient access to the instances without exposing them directly to the internet.

Utilize existing IAM role for access control.

Evaluate the Options:

Option A: Use AWS Systems Manager Session Manager.

Allows secure and auditable SSH or RDP access to EC2 instances without the need for bastion hosts or

opening inbound ports.

Add a policy to allow the ssm:StartSession action.

Option B: Use Elastic IP and security group.

Exposes instances to direct access, increasing security risks.

Option C: Use a bastion host.

Requires additional infrastructure and maintenance.

Option D: Use an internet-facing Network Load Balancer.

Exposes instances to direct access via load balancer, not ideal for private subnets.

Select the Best Solution:

Option A: Using AWS Systems Manager Session Manager is the most secure and efficient solution. It

eliminates the need for additional infrastructure and avoids exposing instances to the internet.

AWS Systems Manager Session Manager

Controlling Access to Session Manager

AWS Systems Manager Session Manager provides secure and auditable access to EC2 instances in a

private subnet using IAM roles.