Admins currently SSH through a bastion host with port 22 open and shared key pairs. Security wants auditable shell access without inbound ports or SSH keys. What replaces the bastion?
A.EC2 Instance Connect
Instance Connect still needs port 22 open and uploads temporary keys.
B.AWS Systems Manager Session Manager
Correct. Agent-based access, IAM auth, no open ports, full session audit.
C.A stronger bastion with a smaller CIDR
A hardened bastion still carries key management and an open port.
D.AWS Site-to-Site VPN for all admins
VPN grants network access but doesn't provide per-session audit.
Why this answer
Session Manager provides interactive shell access through the SSM agent — no inbound ports, no key pairs, IAM-controlled access, and session logging to CloudWatch/S3 for audit. It's the managed bastion-killer.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation