Install and configure EC2 Instance Connect on the fleet of EC2 instances. Remove all security group rules attached to

EC2 instances that allow inbound TCP on port 22. Advise the engineers to remotely access the instances by using the

EC2 Instance Connect CLI.

Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer's

devices.Install the Amazon CloudWatch agent on all EC2 instances and send operating system audit logs to CloudWatch

Logs.

Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer's

devices.Enable AWS Config for EC2 security group resource changes. Enable AWS Firewall Manager and apply a

security group policy that automatically remediates changes to rules.

Create an IAM role with the AmazonSSMManagedInstanceCore managed policy attached. Attach the IAM role to all

the EC2 instances. Remove all security group rules attached to the EC2 instances that allow inbound TCP on port 22.

Have the engineers install the AWS Systems Manager Session Manager plugin for their devices and remotely access the

instances by using the start-session API call from Systems Manager.