A company exposes administration ports directly to the internet for routine EC2 maintenance. It wants audited access without inbound SSH. Which design is preferred?

1. Replace SSH with unauthenticated HTTP on port 80.
2. Use Systems Manager Session Manager with scoped permissions and the required instance connectivity.
3. Keep port 22 open globally and rotate the instance Name tag.
4. Share one private SSH key across every engineer and instance.