Your company is planning to host its AWS resources on AWS. A company policy mandates that all SSH key pairs of EC2 instances are completely managed within the company itself. Which of the following is the correct measure of following this policy?

Answer options:

A.Use the AWS KMS service to create the keys, and the company manages the key lifecycle thereafter.
B.Generate the key pairs for the EC2 Instances using tools such as ssh-keygen or puttygen.
C.Use the EC2 Key pairs that come with AWS.
D.Use S3 server-side encryption.

Answer – B
You need to generate the SSH key pairs of EC2 Instances by third-party tools so that you can have complete control of the access keys.
Option A is incorrect because KMS does not manage the SSH key pairs of EC2 instances.
Option C is incorrect because it means that AWS has ownership of the keys. And the question specifically mentions that you need ownership of the keys.
Option D is incorrect because S3 server-side encryption does not manage the SSH key pairs of EC2 instances.
For information on security for Compute Resources, please visit the below URL:
https://d1.awsstatic.com/whitepapers/Security/Security_Compute_Services_Whitepaper.pdf