A critical monolithic application runs on an Amazon EC2 instance (Amazon Linux 2). The legal department requires the instance’s encrypted EBS volume data to be backed up to an S3 bucket. The application team does not have the instance’s administrative SSH key pair, and the application must remain serving users during the backup. Which solution meets these requirements?

The correct solution leverages AWS Systems Manager Session Manager, which allows secure access to the EC2 instance without needing an SSH key pair. Attaching an IAM role with S3 write permissions to the instance grants the necessary authorization for the application to upload data to S3. This approach ensures the application remains available during the backup, fulfilling the requirement for continuous service. Incorrect options: Creating an AMI with the reboot option enabled would cause downtime, violating the requirement for the application to remain serving users. Taking an EBS snapshot with DLM backs up the volume but doesn't directly copy the data to S3 in a user-accessible format, nor does it address the requirement of copying the data from the instance. Creating an AMI and launching a new instance would also introduce downtime for the original application during the AMI creation process, failing the availability requirement.