The correct answer is: Publish VPC flow logs to Amazon CloudWatch Logs. Create required metric filters. Create an Amazon CloudWatch metric alarm with a notification action for when the alarm is in the ALARM state.

Explanation:
VPC flow logs capture IP traffic data to and from network interfaces in your VPCs. By publishing these logs to CloudWatch Logs, you can use metric filters to detect traffic patternssuch as established SSH (port 22) or RDP (port 3389) connections. You can then configure a CloudWatch alarm to trigger when such access is detected and send notifications via Amazon SNS to the operations team. This is a scalable, near-real-time, and low-maintenance solution.

Why the other options are incorrect:

Amazon CloudWatch Application Insights is used for monitoring and diagnostics of application performance and health, not for detecting RDP/SSH access specifically.
Attaching an IAM role with AmazonSSMManagedInstanceCore enables Systems Manager access but does not track or alert on network-level RDP/SSH logins.
Amazon EventBridge rules for EC2 state-change notifications can notify on instance lifecycle events (like start, stop, terminate) but cannot detect interactive access (like SSH or RDP sessions).

Tip: SSH and RDP sessions leave identifiable patterns in VPC flow logs, making them ideal for detection using log-based monitoring.

Full AWS Practitioner Certification Question