A company runs its application on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. A security engineer suspects some incoming requests are malicious and needs to inspect the running container to retrieve log files and memory dumps with minimal operational overhead. Which approach meets these requirements?

The correct approach is to use ECS Exec. Granting the ECS task role AWS Systems Manager (SSM) permissions and enabling ECS Exec for the service allows security engineers to directly execute commands within a running container on Fargate, retrieve log files, and perform memory dumps with minimal operational overhead. This method provides direct access without altering the application or underlying infrastructure. Migrating to EC2 (incorrect option 1) introduces significant operational overhead and defeats the purpose of using Fargate for serverless containers. Modifying the application to write to STDOUT (incorrect option 2) is good for general logging but doesn't allow for on-demand memory dumps or inspection of the running container state without code changes. Enabling CloudWatch Container Insights with AWS Distro for OpenTelemetry (incorrect option 3) is excellent for monitoring and collecting metrics/traces, but it doesn't provide direct shell access or the ability to perform memory dumps on a running container.