(Author here) At Transcend, we use a bastion host (like others have mentioned). The key difference that we do that I don't think has been covered is that our b

(Author here) At Transcend, we use a bastion host (like others have mentioned). The key difference that we do that I don't think has been covered is that our bastion only makes outgoing connections, and has no open ports to the world. Using the AWS SSM managed service, we can create bastions that have no ingress at all. I talk through some different approaches in a codelab over here: https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html?index=..%2F..index#0 https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index...