A research company runs daily simulations on hundreds of Amazon Linux 2 EC2 instances. Occasionally an instance requires an engineer to SSH in to resolve a stuck simulation. The security policy requires that no two EC2 instances share the same SSH key and that all SSH connections are logged in AWS CloudTrail. How can a solutions architect meet these requirements?

The correct solution leverages EC2 Instance Connect, which allows engineers to push a temporary SSH public key to an instance and connect using their own private key. This ensures each connection uses a unique, temporary key, satisfying the "no two instances share the same SSH key" requirement implicitly, as the public key is ephemeral. The SendSSHPublicKey action is logged in CloudTrail, meeting the logging requirement. Engineers connect via the browser-based client or their own SSH client after the public key is pushed. The other options are less secure or more complex. Generating unique keys per instance and storing them in Secrets Manager (option 1) is cumbersome for hundreds of instances and requires engineers to manage private keys. Using an SSM document to set new keys (option 2) is less secure as it involves persistent keys and more manual steps. Storing keys in Secrets Manager with daily rotation via Lambda (option 4) is overly complex and still involves persistent keys, which is less secure than ephemeral keys from Instance Connect.