A company runs demonstration environments for its customers on Amazon EC2 instances. Each environment is isolated in its own VPC. The company’s operations team needs to be notified when RDP or SSH access to an environment has been established.

The correct solution involves publishing VPC flow logs to CloudWatch Logs. Flow logs capture IP traffic information, including source and destination IPs, ports, and protocols. By creating metric filters on these logs, you can identify RDP (port 3389) and SSH (port 22) connections. A CloudWatch alarm can then be configured to trigger a notification when these specific connection attempts are detected. Incorrect options: CloudWatch Application Insights is for monitoring application health and performance, not for detecting specific network access events like RDP/SSH connections. Configuring an IAM instance profile with AmazonSSMManagedInstanceCore policy allows Systems Manager to manage the instance but does not inherently provide notifications for RDP/SSH access. An EventBridge rule for EC2 Instance State-change Notification only triggers when an instance changes state (e.g., running, stopped), not when RDP/SSH access is established.