A startup runs a fleet of Amazon Linux 2 EC2 instances in private subnets and engineers rely on SSH for troubleshooting. The VPC has private and public subnets, a NAT gateway, and a Site-to-Site VPN to on-premises. Current EC2 security groups allow direct SSH from the on-premises network. The company wants stronger SSH controls and auditing of commands run by engineers. Which approach should a solutions architect recommend?

The correct answer leverages AWS Systems Manager Session Manager, which provides secure and auditable access to EC2 instances without opening inbound SSH ports. Attaching an IAM role with AmazonSSMManagedInstanceCore allows instances to communicate with the SSM service. Session Manager encrypts traffic, integrates with IAM for authentication and authorization, and can log session activity to S3 or CloudWatch Logs for auditing, meeting the requirement for stronger controls and auditing. Removing direct SSH access enhances security by eliminating a common attack vector. The other options are less effective. EC2 Instance Connect is good for secure SSH but doesn't inherently provide command auditing or eliminate the need for SSH ports. Restricting SSH by IP is cumbersome, difficult to manage for dynamic IPs, and doesn't provide command auditing. AWS Config and Firewall Manager help with security group compliance but don't address the core need for auditable, port-less access.