Which solution will meet these requirements with the LEAST operational overhead?
Use the EC2 serial console to directly access the terminal interface of each instance for administration.
Attach the appropriate IAM role to each existing instance and new instance. Use AWS Systems Manager Session Manager to establish a remote SSH session.
Create an administrative SSH key pair. Load the public key into each EC2 instance. Deploy a bastion host in a public subnet to provide a tunnel for administration of each instance.
Establish an AWS Site-to-Site VPN connection. Instruct administrators to use their local on-premises machines to connect directly to the instances by using SSH keys across the VPN tunnel.
Explanations:
The EC2 serial console is useful for troubleshooting but does not provide a secure and scalable solution for remote access and administration of multiple instances. It requires direct console access and can be cumbersome for managing many instances.
AWS Systems Manager Session Manager allows for secure and remote access to EC2 instances without the need for SSH or bastion hosts. It leverages IAM roles for permissions, ensuring a repeatable process with minimal operational overhead. This aligns with AWS best practices.
While using SSH keys and a bastion host can work, it introduces additional complexity and operational overhead in managing the bastion host and key pairs, which may not scale well for many instances. It also does not fully leverage native AWS services for simplicity and security.
Establishing a Site-to-Site VPN adds unnecessary complexity and operational overhead. It requires additional configuration and management of the VPN, and it may not be as secure or efficient as using Systems Manager for instance management.
In my experience, the answer is:
Attach the appropriate IAM role to each existing instance and new instance. Use AWS Systems Manager Session Manager to establish a remote SSH session.