Launch new EC2 instances. Generate an individual SSH key for each new EC2 instance. Store the SSH key in AWS Secrets Manager. Create a new IAM policy. Attach the IAM policy to the engineers ' IAM role with an Allow statement for the GetSecretValue action. Instruct the engineers to retrieve the SSH key from Secrets Manager when the engineers connect through any SSH client.

Create an AWS Systems Manager document to run commands on EC2 instances to set a new unique SSH key. Create a new IAM policy. Attach the IAM policy to the engineers ' IAM role with an Allow statement to run Systems Manager documents. Instruct the engineers to run the document to set an SSH key and to connect through any SSH client.

Launch new EC2 instances without setting up any SSH key for the new EC2 instances. Set up EC2 Instance Connect on each new EC2 instance. Create a new IAM policy. Attach the IAM policy to the engineers ' IAM role with an Allow statement for the SendSSHPublicKey action. Instruct the engineers to connect to the EC2 instances by using Instance Connect from the AWS CLI.

Set up AWS Secrets Manager to store the EC2 SSH key. Create an AWS Lambda function to create a new SSH key and to call AWS Systems Manager Session Manager to set the SSH key on the EC2 instance. Configure Secrets Manager to use the Lambda function to automatically rotate the SSH key once daily. Instruct the engineers to retrieve the SSH key from Secrets Manager when the engineers connect through any SSH client.

C

C is correct because EC2 Instance Connect pushes a temporary SSH public key to the instance for a short connection window instead of relying on long-lived shared key pairs. This satisfies the requirement that each SSH session use a unique key. AWS documentation states that the SendSSHPublicKey API pushes an SSH public key to the specified instance and that the key remains for 60 seconds. EC2 API calls, including SendSSHPublicKey, are recorded in CloudTrail, which gives the company auditable connection records. Secrets Manager key storage does not inherently log actual SSH connection attempts and still leaves operational complexity around key retrieval and rotation. Systems Manager documents also do not provide the clean session-specific SSH key behavior that EC2 Instance Connect provides.