A private application needs temporary administrative access without permanent public SSH exposure. Which OCI capability should be evaluated?

1. A public bucket containing the target's root key.
2. Bastion with scoped, time-limited sessions and the required private network access.
3. A budget alert configured on TCP port 22.
4. A service gateway used as an arbitrary SSH jump host.