An application runs on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Instance logs are copied to a central S3 bucket every 15 minutes. The security team found that logs from some terminated instances are missing. Which set of steps will ensure logs from terminating EC2 instances are copied to the central S3 bucket before those instances are terminated?

The correct option uses an Auto Scaling lifecycle hook to pause instance termination, allowing a Lambda function to trigger an AWS Systems Manager (SSM) document via SendCommand to copy logs to S3. Sending CONTINUE to the Auto Scaling group then allows the instance to terminate. This ensures logs are captured before termination. The first incorrect option is flawed because sending ABANDON prevents termination, requiring manual intervention or a separate mechanism to terminate the instance, which is not scalable or automated. The third incorrect option's approach of changing the log interval is reactive and doesn't guarantee logs from the final moments of termination. Running user data scripts via CLI on a terminating instance is unreliable as the instance may already be shutting down. The fourth incorrect option incorrectly suggests sending ABANDON to terminate the instance, which is contradictory; ABANDON prevents termination.