AWS Certified SysOps Administrator – Associate — Question 274

A company's security policy states that connecting to Amazon EC2 instances is not permitted through SSH and ROP. If access is required, authorized staff can connect to instances by using AWS Systems Manager Session Manager.

Users report that they are unable to connect to one specific Amazon EC2 instance that is running Ubuntu and has AWS Systems Manager Agent (SSM Agent) pre-installed. These users are able to use Session Manager to connect to other instances in the same subnet, and they are in an IAM group that has Session Manager permission for all instances.

What should a SysOps administrator do to resolve this issue?

Answer options

• A. Add an inbound rule for port 22 in the security group associated with the Ubuntu instance.
• B. Assign the AmazonSSMManagedInstanceCore managed policy to the EC2 instance profile for the Ubuntu instance.
• C. Configure the SSM Agent to log in with a user name of “ubuntu”.
• D. Generate a new key pair, configure Session Manager to use this new key pair, and provide the private key to the users.

Correct answer: B

Explanation

For AWS Systems Manager to communicate with an EC2 instance, the instance must have an IAM instance profile attached that grants the required permissions, which are provided by the AmazonSSMManagedInstanceCore managed policy. Since other instances in the same subnet work and the users have the correct IAM group permissions, the issue is isolated to the instance's own IAM role. Session Manager does not require open inbound ports like port 22 or SSH key pairs, making the other options incorrect.