A private server needs occasional administrator access without standing public SSH exposure. Which capability is appropriate?

1. Bastion with scoped, time-limited sessions and the necessary network path.
2. A public bucket containing root login material.
3. Public SSH from every address with one shared key.
4. A service gateway used as an arbitrary SSH proxy.