Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 908 discussion

A - It leverages AWS-managed solutions that simplify operations, enhance security, and meet the requirement for both console and OS-level access, while avoiding the pitfalls of SSH-based access or local user management, so this is what we're looking for. B - Providing local IAM user credentials increases operational overhead and security risks. Managing these credentials across multiple AWS accounts can lead to inconsistency and potential vulnerabilities. C - Allowing SSH access via security groups and distributing SSH key pairs introduces significant security risks. Keys could be lost or misused, and managing IP address ranges is not a piece of cake. D - Bastion hosts require ongoing maintenance and monitoring to ensure security, which is unnecessary with Session Manager.

B: I believe the Session Manager may not have the capability to provide IAM user credentials. If it were to do so, it could potentially lead to security concerns.

A or B. Exam not tell if they have IDP and no. of outsource.

A: This solution minimizes the attack surface by eliminating the need for SSH access, avoids bastion hosts, and provides secure, auditable, and federated access to AWS resources.

A use MSM

Systems Manager Session Manager allows secure, auditable, and controlled access to your EC2 instances without needing to open SSH ports or manage SSH keys, reducing the attack surface. Local IAM user credentials are less secure and harder to manage at scale compared to using IAM Identity Center.