An application requires private administration but no standing public SSH exposure. Which combination best fits the requirement?

1. A service gateway used as an interactive SSH proxy.
2. Private compute instances and controlled, time-limited Bastion sessions with scoped IAM.
3. Public SSH from any address with a shared permanent key.
4. A budget threshold that disables SSH authentication.