Question

A company runs a fleet of Linux EC2 instances in private subnets with no route to the internet and no public IP addresses. Security policy prohibits any inbound SSH access and forbids deploying bastion hosts. Administrators still need interactive shell access for troubleshooting, and all sessions must be logged for audit. Which approach meets these requirements with the least additional attack surface?

Accepted Answer

Use AWS Systems Manager Session Manager with the SSM Agent, VPC interface endpoints for ssm, ssmmessages, and ec2messages, and an instance profile granting the required SSM permissions; log session output to S3/CloudWatch Logs.

Answer

Deploy a NAT gateway so the instances can reach the SSM public endpoints over the internet, then connect via Session Manager.

Answer

Open TCP 22 in the security group only to the corporate CIDR range and connect over the Direct Connect link.

Answer

Create an EC2 Instance Connect Endpoint and allow inbound SSH from the endpoint's security group to the instances.