Exam AWS Certified Security - Specialty topic 1 question 497 discussion

why i think Option B is not valid here; Option B: The traffic from Systems Manager to the EC2 instance is initiated by the instance itself, not by Systems Manager. The EC2 instances themselves initiate the traffic to Systems Manager, not the other way around. This is because the instances need to reach out to the Systems Manager service to receive commands and configurations.

https://aws.amazon.com/fr/blogs/mt/automated-configuration-of-session-manager-without-an-internet-gateway/

Refer to the docs: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html The managed nodes you connect to must also allow HTTPS (port 443) outbound traffic to the following (public) endpoints. Alternatively, you can connect to the required endpoints by using interface endpoints. and no inbound ports are required (remember, SGs are stateful) on the EC2 instance itself, refer to: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html You can use this functionality to connect to managed nodes without opening inbound ports or maintaining bastion hosts.

One of the benefits of session manager is that it "provides secure and auditable node management without the need to open inbound ports." In other words, the EC2 instance has no need for open inbound ports (SGs are stateful). https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html#session-manager-who The default outbound security group rules normally allow all ports, protocols, and IP addresses: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/default-custom-security-groups.html#default-security-group Restricting outbound connections to port 443 is a better security practice and necessary to connect to the VPC endpoint: https://repost.aws/questions/QUARF56BqXQaKrU27VTPSNYQ/security-group-for-session-manager No trolls that I see.

B+D+E be careful from AWS trolls... they're trying very hard to mislead you Lol...

A. Update the EC2 instance security group to add a rule that allows outbound traffic on port 443 for 0.0.0.0/0: By allowing outbound traffic on port 443, the EC2 instance will be able to establish a connection to the Systems Manager service. D. Create a VPC interface endpoint for Systems Manager in the VPC where the EC2 instance is located: Creating a VPC interface endpoint enables private access to the Systems Manager service within the VPC. E. Attach a security group to the VPC interface endpoint and allow inbound traffic on port 443 to the VPC's CIDR range: By attaching a security group to the VPC interface endpoint and allowing inbound traffic on port 443 from the VPC's CIDR range, the necessary network connectivity is established for Systems Manager to communicate with the EC2 instance securely.