A company runs an application on Amazon EC2 instances that process confidential customer data. The company must restrict access and does not allow opening inbound ports, maintaining bastion hosts, or managing SSH keys. A security engineer needs secure access to the instances and wants to capture, store, and access fully encrypted session logs. Which solution meets these requirements?

The correct answer is to use AWS Systems Manager Session Manager because it allows secure, auditable access to EC2 instances without opening inbound ports, managing SSH keys, or using bastion hosts, directly addressing the core requirements. Session Manager can be configured to send session logs to Amazon CloudWatch Logs, and the option to enable upload of session logs and allow only encrypted CloudWatch Logs log groups ensures that the logs are captured, stored, and encrypted as required. AWS Control Tower and AWS Security Hub are incorrect because they are governance and security posture management services, respectively, and do not provide direct access to EC2 instances. The third incorrect option, while using Session Manager, incorrectly states "Configure Amazon CloudWatch monitoring to record sessions" instead of "logging," and "store session logs in selected CloudWatch Logs log groups" does not explicitly mention the encryption requirement for the log groups.