Administrators need controlled SSH access to private Linux instances without assigning the instances public IP addresses. Which OCI capability is a suitable option?

1. Use a budget notification as an SSH tunnel
2. Put the SSH private key in each instance's public display name
3. OCI Bastion with supported sessions and scoped access controls
4. Publicly expose SSH on every instance to all sources