(Author here) I think the second most secure way to handle service authentication is to protect your ports with strong auth, like this article talks about. Bu

(Author here) I think the second most secure way to handle service authentication is to protect your ports with strong auth, like this article talks about. But the most secure way to handle this is to just eliminate the open port entirely. Here's another post of mine where I talk about making a bastion host with no open ports and no ingress on its security group: https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html?index=..%2F..index#0 https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index...