I use almost the same approach. I also limit access to just one IP, which is a VPN server hosted on a different cloud provider. You can run a bulletproof VPN

I use almost the same approach. I also limit access to just one IP, which is a VPN server hosted on a different cloud provider. You can run a bulletproof VPN server easily using something like algo (https://github.com/trailofbits/algo https://github.com/trailofbits/algo)