A financial services company requires that DevOps engineers should not log directly into Amazon EC2 instances that process highly sensitive data except in exceptional circumstances. The security team requires a notification within 15 minutes if a DevOps engineer does log in to an instance. Which solution will meet these requirements with the least operational overhead?