On-call engineers must frequently access EC2 instances in a private subnet for troubleshooting. Instances run either current AWS Windows AMIs or Amazon Linux, and an IAM role already exists for authorization. Which solution grants the engineers access by using IAM permissions on that role?

The correct solution is to use AWS Systems Manager Session Manager. By adding a policy statement to the IAM role that allows ssm:StartSession for the instances, engineers can securely access the EC2 instances in a private subnet without opening inbound ports or managing SSH keys. Session Manager uses IAM for authentication and authorization, aligning with the existing IAM role. Assigning Elastic IPs and whitelisting IPs is insecure and impractical for many instances in a private subnet. Building a bastion host adds complexity and management overhead, and ec2:CreateVpnConnection is for VPNs, not direct instance access. Deploying an internet-facing Network Load Balancer exposes instances to the internet, which is a security risk for private subnets, and ec2:CreateRoute is for route tables, not direct instance access.