Which solution will meet this requirement with the LEAST amount of administrative overhead?

Explanations:

AWS Systems Manager Session Manager provides a secure and managed way to access EC2 instances without the need for SSH keys. It allows administrators to connect to instances directly through the AWS Management Console or AWS CLI, eliminating the need for shared keys and reducing administrative overhead. Additionally, it provides session logging and auditing capabilities, enhancing security.

While AWS Security Token Service (AWS STS) can generate temporary credentials, it does not directly generate SSH keys. Implementing a solution that creates on-demand SSH keys would require additional complexity and management, which is counterproductive to the goal of reducing administrative overhead.

Using bastion instances allows for controlled access to other instances, but it still involves shared SSH keys unless replaced with individual user keys or other authentication methods. This option introduces additional management overhead in maintaining the bastion host and does not fully comply with the requirement to eliminate shared keys.

Implementing an Amazon Cognito custom authorizer and a Lambda function to generate temporary SSH keys is overly complex and introduces significant administrative overhead. This solution requires additional setup, management of the Lambda function, and integration with Cognito, which does not align with the requirement for minimal administrative burden.