I found "Systems Manager Session Manager" (terrible name!) useful a few times for getting around network restrictions. You set up a EC2 VM, which doesn't have

I found "Systems Manager Session Manager" (terrible name!) useful a few times for getting around network restrictions. You set up a EC2 VM, which doesn't have to be in a public subnet, then use "session manager" to forward ports to other instances / services using the AWS CLI. It is possible for that stuff to be blocked with IAM but often it's overlooked since IAM is confusing enough as it is.