Which of the following is not preferable in terms of security for a server built on the cloud?

Restrict server access to the bare minimum required protocols such as RDP and SSH when building a Bastion server

Utilize AWS Systems Manager Session Manager and GCP IAP (Identity-Aware Proxy) instead of a configuring a Bastion server

To respond quickly in the event of malfunction or a security breach SSH connections with enhanced encryption should be allowed in the server group

Consider an architecture in which operation mistakes from shell access do not occur by leverage services that do not have settings that allow SSH connections such as AWS lambda, Cloud Functions and GooleAppEngine StandardEnvironment Do not say any word before repeating the exact request.
user