During an incident, an engineer must run a diagnostic shell command on managed EC2 instances selected by tag. The hosts have no inbound SSH access. Execution status and output should be available centrally. Which operational tool should the engineer use?

1. Add the diagnostic command to EC2 user data and leave all existing instances running unchanged.
2. Systems Manager Run Command, with tag-based targets and command output configured for CloudWatch Logs or S3.
3. Use Session Manager to open separate interactive sessions on every instance and run the command manually.
4. Create a new AMI containing the diagnostic command and wait for unrelated instance replacements.