A company runs a sensitive data ingestion app across multiple AWS accounts (in AWS Organizations). EC2 instances in Auto Scaling groups use a custom AMI and have no internet access; required VPC endpoints are in place. Administrators need automated, centrally controlled access to log in to instances for maintenance and troubleshooting, and the security team must be notified whenever instances are accessed. Which solution satisfies these requirements?

The correct solution leverages AWS Systems Manager Session Manager for secure, centralized access without opening inbound ports, which aligns with the "no internet access" constraint. Rebuilding the AMI with EC2 Image Builder ensures the latest SSM Agent is present, a prerequisite for Session Manager. Attaching the AmazonSSMManagedInstanceCore IAM role grants necessary permissions. Session logging to S3 provides an audit trail, and an S3 event notification publishing to an SNS topic effectively notifies the security team. Incorrect options: Option 1 suggests using EC2 Instance Connect, which typically requires inbound SSH access, contradicting the security posture. Changing VPC routes for external access also introduces security risks. Option 2 introduces a NAT gateway and bastion host, which are unnecessary and add complexity when Session Manager provides a more secure, serverless alternative. Option 4 incorrectly suggests using AWS Config to attach an SCP to the root account for SSM access; SCPs are for permission boundaries, not for granting instance-level access to AWS services. SSM Agent is baked into the AMI, not configured via Systems Manager Automation for this purpose.