A company needs to manage Amazon EC2 instances from the command line for both Linux and Windows hosts. The EC2 instances are in an environment without internet access. Role-based access control must be enforced for instance management. The company’s on-premises environment is standalone. Which approach meets these requirements with the least operational overhead?

The correct answer is to install and configure the AWS Systems Manager Agent (SSM Agent) on each instance and use Session Manager with VPC endpoints. This approach allows command-line management of EC2 instances without internet access, as Session Manager communicates over private VPC endpoints. It enforces role-based access control through IAM policies and has low operational overhead because it eliminates the need for managing SSH keys or bastion hosts. Incorrect options: Direct Connect and Site-to-Site VPN provide network connectivity but still require a separate mechanism for instance management (like SSH or RDP), often involving jump hosts or public IPs, which increases operational overhead and security complexity. Deploying an intermediary appliance with a public IP address introduces a single point of failure, requires managing the appliance, and exposes a public IP, which is contrary to the "no internet access" requirement for the instances themselves.