Connecting Securely to Amazon EC2 Instances – SAP-C02 Study Guide

Purpose of This Lesson

Amazon EC2 instances can be administered through several connection methods. The appropriate choice depends on the operating system, network placement, security requirements, and whether the instance has public connectivity.

This guide covers:

• Connecting to Linux instances with SSH and EC2 Instance Connect
• Connecting to Windows instances with RDP
• Using AWS Systems Manager Session Manager as a private-access alternative
• Required security group rules and credentials
• The operational difference between stopping and terminating an instance

Key Concepts

EC2 Instance Connect for Linux

EC2 Instance Connect provides browser-based SSH access to supported EC2 instances. It temporarily pushes a public key to the instance for the connection rather than requiring the operator to manage a long-lived private key for every login.

Typical requirements include:

• A supported operating system and an installed/configured EC2 Instance Connect package
• An SSH service listening on port 22
• A security group rule permitting SSH from the appropriate source
• Network reachability to the instance
• An IAM principal authorized to use EC2 Instance Connect

For an instance with a public IPv4 address, the EC2 console can often establish the connection directly. Instances in private subnets generally require private connectivity, such as an EC2 Instance Connect Endpoint, bastion architecture, or Systems Manager Session Manager.

A public IP address alone is not sufficient. The route table, network ACLs, security group, operating system firewall, SSH daemon, and IAM permissions must also allow the connection.

SSH from an External Client

A traditional SSH connection uses the private key associated with the EC2 key pair created or selected at launch. A common Linux command is:

ssh -i /path/to/private-key.pem ec2-user@public-dns-name

The default username depends on the AMI. Examples include:

• Amazon Linux: ec2-user
• Ubuntu: ubuntu
• RHEL: ec2-user or another documented AMI user
• Debian: admin or an AMI-specific user

The private key must be protected with appropriate filesystem permissions. The security group should permit TCP port 22 only from the required administrative source, such as a corporate CIDR range or VPN address—not generally from 0.0.0.0/0.

Systems Manager Session Manager

Session Manager provides shell access to an EC2 instance without opening inbound SSH or RDP ports. It is usually the preferred option when instances should remain in private subnets.

Important prerequisites include:

• SSM Agent installed and running on the instance
• An instance profile with permissions such as AmazonSSMManagedInstanceCore
• Outbound connectivity from the instance to Systems Manager endpoints
• NAT gateway connectivity or VPC interface endpoints for Systems Manager-related services when no internet path exists
• An IAM user or role permitted to start sessions

Session Manager improves security by removing the need for inbound port 22 or 3389, eliminating direct public exposure, and enabling centralized IAM and session logging. It is not a replacement for every administrative protocol, however; applications that require native SSH or RDP behavior may still need another access design.

RDP for Windows Instances

Windows EC2 instances are commonly administered with Remote Desktop Protocol over TCP port 3389. An RDP client is required on the administrator’s workstation.

For a newly launched Windows instance, the initial administrator password is encrypted with the EC2 key pair. The private key is uploaded in the EC2 console to decrypt and retrieve that password. The private key is not transmitted to the instance as the Windows login password; it is used to decrypt the password returned by EC2.

The connection normally uses:

• The instance’s public IPv4 address or public DNS name
• Username: commonly Administrator
• The decrypted Windows administrator password
• A security group rule permitting TCP port 3389 from the administrator’s trusted source

As with SSH, exposing RDP to the entire internet is a significant security risk. Prefer VPN, Direct Connect, a bastion or jump-host design, Session Manager, or another controlled access path.

Public and Private Subnet Connectivity

An instance in a public subnet needs all of the following for direct internet administration:

• A public IPv4 address or Elastic IP address
• A route to an internet gateway
• Security group access
• Network ACLs that allow the traffic and return path
• An operating system service listening on the required port

An instance in a private subnet does not accept direct inbound connections from the internet. Common administrative options include:

• Systems Manager Session Manager
• EC2 Instance Connect Endpoint for supported SSH workflows
• A bastion host in a public subnet
• Site-to-site VPN or Direct Connect from an administrative network
• Centralized management tooling or automation

EC2 Instance Lifecycle Actions

EC2 actions have different cost and data-retention consequences:

Action	Compute billing	EBS root volume	Instance data and identity
Reboot	Continues after restart	Preserved	Instance remains the same
Stop	Stops instance compute billing	Usually preserved and still billed	Private/public addressing behavior may change after restart
Terminate	Instance is deleted	Root EBS volume is deleted by default if DeleteOnTermination is enabled	Instance cannot be restarted

Stopping an instance generally preserves its EBS volumes, but EBS storage continues to incur charges. Public IPv4 addresses are typically released when an instance is stopped and restarted unless an Elastic IP is used. Termination is destructive and should be protected by appropriate IAM permissions, termination protection, backups, and infrastructure-as-code recovery procedures.

Exam-Relevant Takeaways

• SSH uses TCP port 22; RDP uses TCP port 3389.
• A key pair’s private key is required for traditional SSH access to Linux instances.
• The Windows initial administrator password is encrypted with the EC2 key pair and can be decrypted using the private key.
• Session Manager can provide shell or PowerShell access without inbound SSH or RDP rules.
• Session Manager requires an SSM-managed instance, IAM permissions, and connectivity to Systems Manager endpoints.
• An instance in a private subnet cannot be reached directly from the internet merely because its security group allows the traffic.
• Security groups are stateful, but they do not create network reachability or supply a route to the instance.
• Avoid using 0.0.0.0/0 for SSH or RDP in production. Restrict access to trusted networks or use private administration paths.
• Stopping an instance removes running compute charges but does not eliminate EBS storage charges.
• Termination is not the same as stopping and may delete the root EBS volume.

Architecture Decision Guide

Requirement	Recommended approach	Main considerations
Quick browser-based SSH to a public Linux instance	EC2 Instance Connect	Requires supported configuration, IAM permission, port 22, and network reachability
Long-lived command-line SSH access	SSH with a protected key pair	Manage private keys carefully; restrict source CIDRs
Administrative access to private instances without inbound ports	Systems Manager Session Manager	Requires SSM Agent, IAM role, and endpoint/NAT connectivity
Native Windows desktop administration	RDP	Requires port 3389; protect with VPN, bastion, private connectivity, or tightly restricted source ranges
SSH access to a private instance from an external operator	EC2 Instance Connect Endpoint or bastion/VPN	Avoid exposing the instance publicly; validate supported workflow and IAM controls
Temporary suspension while retaining the instance	Stop	EBS charges continue; public IPv4 may change
Permanent removal of a test instance	Terminate	Verify backups and DeleteOnTermination behavior first

Common Exam Traps

• Assuming a public IP automatically makes an instance reachable: Routing, security groups, network ACLs, host firewalls, and listening services must all align.
• Opening port 22 or 3389 to 0.0.0.0/0 as the default answer: This may work technically but is usually not the secure architecture the exam expects.
• Confusing Session Manager with a network tunnel: Session Manager provides managed sessions through AWS Systems Manager; it does not simply make the instance publicly reachable.
• Forgetting the SSM instance role: Installing or running the SSM Agent alone does not grant the instance permission to register and communicate with Systems Manager.
• Assuming private-subnet instances need public IP addresses for Session Manager: They can use VPC interface endpoints or another outbound path instead.
• Treating stop and terminate as equivalent: Stop preserves the instance and usually its EBS volumes; terminate deletes the instance and may delete attached root storage.
• Using the wrong Linux username: The login name is AMI-specific and is not always ec2-user.
• Assuming the EC2 private key is the Windows password: It decrypts the initial password; it is not itself used as the Windows password.

Real-World Engineer Notes

• Use Session Manager as the default administrative path for production instances where possible. It reduces exposed attack surface and supports IAM-based access control, audit trails, and centralized operations.
• If SSH or RDP is required, place access behind a VPN, private connectivity, zero-trust access layer, or tightly controlled bastion host.
• Never store EC2 private keys in source control or broadly shared file locations. Use a controlled secrets or key-management process and rotate access by replacing authorized keys or using centralized identity mechanisms.
• For automated administration, prefer Systems Manager Run Command, State Manager, automation documents, or configuration management over manually logging into servers.
• Use Elastic IP addresses only when a stable public address is genuinely required. For private administration, stable private DNS and managed connectivity are usually safer.
• Before terminating an instance, confirm whether data resides on the root volume, instance store, or additional EBS volumes and whether backups or snapshots exist.
• Logging Session Manager activity to CloudTrail, CloudWatch Logs, or Amazon S3 can support compliance and incident investigation, but logging must be explicitly configured.

Quick Reference Summary

• Linux traditional access: SSH, TCP 22, AMI-specific username, private key.
• Linux browser access: EC2 Instance Connect, with IAM and network/security prerequisites.
• Windows desktop access: RDP, TCP 3389, commonly Administrator, decrypted initial password.
• Private-instance access: Session Manager, EC2 Instance Connect Endpoint, VPN, Direct Connect, or bastion.
• Session Manager security model: no inbound SSH/RDP required, but SSM Agent, IAM, and outbound endpoint connectivity are required.
• Stop: retains the instance and EBS storage but stops compute billing.
• Terminate: deletes the instance and may delete EBS volumes configured for deletion.

Flashcards

1. Q: Which port does SSH use for EC2 Linux administration by default?

A: TCP port 22.

1. Q: Which port does RDP use for Windows EC2 administration by default?

A: TCP port 3389.

1. Q: What does the EC2 private key do when retrieving a Windows instance password?

A: It decrypts the encrypted initial administrator password.

1. Q: What is the primary security advantage of Systems Manager Session Manager?

A: It can provide shell or PowerShell access without opening inbound SSH or RDP ports.

1. Q: What three categories of prerequisites are important for Session Manager?

A: SSM Agent availability, IAM permissions for the instance and operator, and network connectivity to Systems Manager endpoints.

1. Q: What username is commonly used for Amazon Linux SSH access?

A: ec2-user, although the correct username is AMI-specific.

1. Q: Why might direct SSH fail even when port 22 is allowed in the security group?

A: The instance may lack a public route/address, a network ACL may block traffic, the host firewall or SSH daemon may reject it, or IAM/Instance Connect requirements may be unmet.

1. Q: What happens to EBS storage charges when an instance is stopped?

A: EBS storage charges generally continue even though running compute charges stop.

1. Q: What is a major consequence of terminating an EC2 instance?

A: The instance is deleted, and volumes configured with DeleteOnTermination—commonly the root volume—may also be deleted.

1. Q: What is a safer alternative to allowing RDP from the entire internet?

A: Use Session Manager, VPN/private connectivity, or a tightly restricted access path such as a bastion host.

Practice Questions

Question 1

A company runs Linux EC2 instances in private subnets. Security policy prohibits inbound SSH from any network. Administrators need interactive shell access, and the instances must not receive public IP addresses. Which design best satisfies the requirements?

A. Add a security group rule for TCP 22 from 0.0.0.0/0
B. Deploy a bastion host with a public IP and allow SSH from the bastion
C. Configure Systems Manager Session Manager with an instance IAM role and private VPC endpoints
D. Assign Elastic IP addresses and use EC2 Instance Connect

Correct answer: C

Explanation: Session Manager provides interactive access without inbound SSH. An instance profile, SSM Agent, and connectivity through Systems Manager VPC endpoints allow the instances to remain private. Option B can work but introduces a publicly reachable bastion and does not best satisfy the policy’s intent.

Question 2

An administrator cannot connect to a public Amazon Linux EC2 instance using EC2 Instance Connect from the console. The instance has a public IPv4 address and the security group permits TCP port 22 from the administrator’s corporate CIDR. What should be checked next?

A. Whether the instance has an RDP listener on port 3389
B. Whether the AMI and instance have EC2 Instance Connect support/configuration and the administrator has the required IAM permission
C. Whether the instance has an Elastic IP instead of an automatically assigned public IP
D. Whether the root EBS volume is encrypted

Correct answer: B

Explanation: EC2 Instance Connect depends on supported instance configuration and IAM authorization in addition to public reachability and SSH security group access. An Elastic IP is not inherently required, and RDP or EBS encryption is unrelated.

Question 3

A Windows EC2 instance is reachable over the network, but an RDP connection fails. The security group allows TCP 3389 only from the company’s VPN CIDR. The administrator is connecting from a home network without first connecting to the VPN. What is the most likely cause?

A. The Windows password must be decrypted again with the key pair
B. The source address is not permitted by the security group
C. RDP requires TCP port 22
D. The instance must be terminated and relaunched

Correct answer: B

Explanation: Security groups evaluate the source IP address. Because the administrator is outside the permitted VPN CIDR, the connection is blocked. The secure solution is to connect through the VPN or another approved private access path, not to broadly expose port 3389.

Question 4

A development team wants to suspend an EC2 instance overnight while retaining its root volume and restarting it the next morning. Which action should be used, and what cost remains?

A. Reboot; all compute and storage charges stop
B. Stop; EBS storage charges continue while compute charges stop
C. Terminate; EBS storage charges continue and the instance can be restarted
D. Hibernate; the instance and all storage are deleted

Correct answer: B

Explanation: Stopping preserves the instance and typically its EBS volumes while stopping instance compute billing. EBS volumes continue to incur storage charges. Termination is destructive and cannot be reversed by restarting.

Question 5

A security team requires that production Windows instances have no inbound internet access but still need occasional administrative PowerShell sessions. Which approach is most appropriate?

A. Permit RDP from 0.0.0.0/0 and rely on the Windows password
B. Use Session Manager, granting controlled IAM permissions and configuring SSM connectivity
C. Assign a public IP and use EC2 Instance Connect for RDP
D. Open TCP port 3389 to the VPC CIDR without configuring any management agent

Correct answer: B

Explanation: Session Manager supports managed PowerShell sessions without inbound RDP. The instance must be managed by Systems Manager and have the required IAM and network configuration. The other choices either expose RDP or omit required management components.