A solutions architect must provide secure Remote Desktop (RDP) access to Windows EC2 instances in a VPC, integrating centralized user management with the company’s on-premises Active Directory. Access to the VPC is over the internet, and the company can establish a Site-to-Site VPN using existing hardware. Which solution is the MOST cost-effective while meeting requirements?

The most cost-effective solution is to leverage existing AWS services. AWS IAM Identity Center (formerly AWS SSO) integrates with on-premises Active Directory via AD Connector, providing centralized user management. AWS Systems Manager Fleet Manager allows RDP access to EC2 instances without opening inbound RDP ports or deploying bastion hosts, reducing security risks and operational overhead. This approach avoids the cost of dedicated RDP gateways or additional EC2 instances for bastions. Incorrect options: Deploying Managed AD and a bastion host adds cost and management overhead for the Managed AD and the bastion instance. A Site-to-Site VPN is mentioned as an option but the question asks for internet access to the VPC, and this option requires all connections to come over the VPN, which might not be practical for all users or devices. Deploying Managed AD and a Remote Desktop Gateway adds significant cost for Managed AD and the dedicated RDP Gateway instances, plus licensing for the RDP Gateway.