SOA-C02 Practice Question 5: Session Manager Managed Node
AWS Certified SysOps Administrator – Associate (SOA-C02) · Test 1 · question 5 of 10
A SysOps administrator wants to open a shell on a new EC2 Linux instance with AWS Systems Manager Session Manager instead of SSH. SSM Agent is preinstalled and running on the instance, and the instance sits in a public subnet with outbound internet access, but the instance never appears in the Systems Manager list of managed nodes and Session Manager cannot connect to it.
What is the most likely cause?
Show answer and explanation
Answer:
SSM Agent authenticates to the Systems Manager service using credentials from the instance profile attached to the EC2 instance. Without an instance profile that grants the API actions in the AWS managed policy AmazonSSMManagedInstanceCore, the agent cannot register, so the instance never becomes a managed node and Session Manager has nothing to connect to. Attaching such a profile is the standard fix.
Option A is wrong because Session Manager deliberately removes the need for inbound SSH. Port 22 is never used, and the whole point of the feature is that no inbound port has to be opened.
Option B is wrong because the connection is outbound from the agent to the Systems Manager endpoints. A public IP or Elastic IP is not required, only a network path (internet access via a NAT gateway or internet gateway, or VPC endpoints).
Option D describes the wrong direction. Session Manager needs *outbound* HTTPS on port 443 from the instance, which the default security group already allows. No inbound rule is required at all.
Reference: Configure instance permissions required for Systems Manager