3.3 - Design and implement compute security (Session Manager, IMDSv2, Patch Manager, IRSA, Nitro Enclaves)

1. Administrators must obtain a shell on private instances without opening port 22 and without a bastion host. What do you deploy?

• A NAT gateway in the public subnet plus an inbound rule limited to the office address range, so that only the corporate network can open a session
• An Elastic IP on each instance combined with a network ACL that only accepts port 22 from the addresses of the administration team
• AWS Systems Manager Session Manager with the SSM agent and an instance profile (correct answer)
• A VPN appliance launched from the marketplace in the public subnet, with client certificates distributed to every administrator of the platform

Session Manager opens the session through an outbound call from the agent to the Systems Manager endpoints, so no inbound port and no public address are needed, and every session is authorized by IAM and logged. A NAT gateway carries outbound traffic only and cannot receive a session, an Elastic IP puts the instance back on the internet, and a VPN appliance is a whole extra component to patch and operate.

2. An application on EC2 is vulnerable to server side request forgery. Which instance setting most reduces the risk of role credential theft?

• Requiring IMDSv2 and setting the metadata hop limit to one (correct answer)
• Detaching the instance profile whenever the application does not need to call an AWS service, then reattaching it through an automation document
• Encrypting the root volume with a customer managed KMS key so that the credential cache written by the agent cannot be read from a snapshot
• Moving the instance into a private subnet whose route table has no path to the internet gateway, which prevents the forged request from leaving

IMDSv2 requires a PUT to obtain a session token before any metadata read, which a forged GET cannot perform, and a hop limit of one stops a container from reaching the metadata service of its host. Detaching the profile breaks the application, disk encryption does nothing against a live process, and a private subnet still lets the forged request target the metadata address itself.

3. Which service builds, tests and distributes hardened machine images on a repeatable pipeline?

• AWS Systems Manager Patch Manager, which applies the missing operating system updates to the instances already running in the account
• Amazon Inspector, which continuously evaluates the packages installed on running instances and reports the vulnerabilities it discovers there
• EC2 Image Builder (correct answer)
• AWS Config, which records the configuration of each image and raises a finding whenever it drifts away from the approved hardened baseline

Image Builder chains build components, hardening steps, tests and distribution to the chosen accounts and regions, which is the golden AMI factory. Patch Manager updates live instances rather than producing images, Inspector finds vulnerabilities without remediating them, and Config observes drift after the fact.

4. In Amazon ECS on Fargate, which role grants the application container itself permission to read from an S3 bucket?

• The task execution role, which the agent uses to pull the image and write the logs of the task to the destination configured in the definition
• The task role (correct answer)
• The instance profile of the container host, inherited by every task that the scheduler happens to place on that particular host of the cluster
• The service linked role of Amazon ECS, which the service creates automatically in the account to manage the resources of the cluster on your behalf

The task role provides the credentials that the application code inside the container retrieves, so this is where S3 permissions belong. The task execution role serves the ECS agent for pulling images and shipping logs, Fargate has no host instance profile to inherit at all, and the service linked role lets ECS manage cluster resources rather than the workload.

5. Which service reports operating system and application vulnerabilities on running EC2 instances and on container images stored in Amazon ECR?

• Amazon Macie, which classifies the sensitive data discovered inside the objects of the buckets it has been asked to monitor in the account
• AWS Security Hub, which aggregates the findings produced by other services and measures them against a set of published security standards
• Amazon GuardDuty, which analyses the log sources of the account in order to surface the behaviour of a compromised workload or credential
• Amazon Inspector (correct answer)

Inspector continuously scans EC2 instances, ECR images and Lambda functions for known vulnerabilities and produces a prioritised risk score. Macie targets sensitive data in S3, Security Hub aggregates findings without generating vulnerability scans of its own, and GuardDuty looks for malicious behaviour rather than missing patches.

6. A Lambda function attached to a VPC can no longer reach a public API. What explains this?

• A function attached to a VPC loses the right to call any public endpoint, and the only supported workaround is to detach it from the VPC entirely
• Public calls from a function inside a VPC require the execution role to carry the AWSLambdaVPCAccessExecutionRole policy before the call succeeds
• Inside a VPC the function uses the subnet route, which needs a NAT gateway or an endpoint (correct answer)
• The concurrency limit of the function has to be raised before the elastic network interfaces needed for outbound public traffic are created by Lambda

Once attached to a VPC, a function sends its traffic through an elastic network interface in the chosen subnet and therefore follows that subnet's route table, so a private subnet needs a NAT gateway or the appropriate VPC endpoint. Attachment does not forbid public calls, the VPC access policy governs interface creation rather than routing, and concurrency has no effect on connectivity.