A company runs many EC2 instances based on the Amazon Linux 2 AMI. The SysOps administrator needs a low-maintenance way to capture interactive user command sessions (commands and their outputs), store those recordings durably, and trigger alerts based on log contents. Which approach provides the required functionality with the least operational overhead?

The correct answer leverages AWS Systems Manager Session Manager, which natively supports streaming session logs to CloudWatch Logs. This provides a low-maintenance, centralized solution for capturing interactive command sessions without requiring agents or custom configurations on each EC2 instance. Once logs are in CloudWatch Logs, metric filters and CloudWatch Alarms can be easily configured to trigger alerts based on log content, fulfilling all requirements with minimal operational overhead. Incorrect options: Enabling command session logging on each instance and using the CloudWatch agent adds operational overhead for configuration and maintenance across many instances. Athena is for querying, not directly creating alerts from CloudWatch Logs metric filters. A bastion host centralizes access but still requires agent installation and maintenance on the bastion itself, and doesn't inherently capture all interactive sessions on other instances unless all access is strictly routed through it. Systems Manager Run Command is for executing commands non-interactively, not for interactive shell access. While it can log output, it doesn't meet the "interactive user command sessions" requirement.