Admins need shell access to private-subnet EC2 instances WITHOUT opening port 22, deploying bastion hosts, or managing SSH keys. Which Systems Manager capability provides this?
A.Run Command
Run Command executes documents — not interactive shells.
B.Session Manager — audited shell sessions via the SSM agent
Correct. Agent-based, keyless, fully audited access.
C.EC2 Instance Connect
EC2 Instance Connect still needs SSH network reachability.
D.AWS Cloud9
Cloud9 is a dev IDE — needs its own connectivity.
Why this answer
Session Manager gives browser/CLI shell access through the SSM agent's outbound channel — no inbound ports, no keys, full session logging to CloudWatch/S3. It's the modern bastion replacement; Run Command is for one-off commands, not interactive shells.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation