A company needs to permanently remove SSH keys from a subset of its Amazon Linux 2 EC2 instances that share the same IAM instance profile. Three users with IAM accounts still require shell access to perform critical tasks. How should a security engineer provide this access?

The correct solution uses AWS Systems Manager Session Manager, which allows secure shell access to EC2 instances without needing SSH keys. By attaching an IAM policy to the instance profile, the instances are enabled for Systems Manager. Granting IAM users permissions to Systems Manager allows them to use Session Manager. This approach enhances security by eliminating SSH keys, which are a common attack vector, while still providing necessary access. The first incorrect option suggests using Systems Manager Inventory to connect, but Inventory is for collecting data, not for interactive shell access. The second incorrect option suggests using Run Command to open an SSH session, which is not how Run Command is typically used for interactive sessions and still implies a need for SSH. The fourth incorrect option suggests using the EC2 console's SSH client feature, which still relies on SSH keys for authentication, contradicting the requirement to remove them.