A company has Linux EC2 instances that users access via SSH with EC2 SSH key pairs. Each instance must have a unique EC2 key pair. The company requires an on-demand automatic rotation process that rotates all EC2 key pairs and stores the keys securely encrypted. The company can tolerate under one minute of downtime during rotation. Which solution satisfies these requirements?

The correct solution leverages AWS Secrets Manager's built-in rotation capabilities. Secrets Manager can store the private keys securely and automatically invoke a Lambda function on a schedule. This Lambda function can then generate new SSH key pairs, update the authorizedkeys file on the respective EC2 instances with the new public keys, and store the new encrypted private keys back in Secrets Manager. This approach meets the requirements for automatic rotation, secure storage, and minimal downtime. Incorrect options: Storing private keys in Systems Manager Parameter Store as plain strings is not secure and lacks native rotation capabilities. AWS KMS is for encrypting data, not for storing or rotating SSH key pairs directly. KMS key rotation applies to the KMS master key, not the SSH key pairs themselves. Fleet Manager and Run Command can execute commands on instances but don't provide a comprehensive solution for secure key storage, automatic rotation, and managing the private keys centrally.