Replacing a Bastion Host with Amazon EC2 Systems Manager.

#Create a EC2 Instance in Private subnet

• create a IAM role attach to the EC2
• Install SSM agent using the below commands as part of userdata.

#!/bin/bash
cd /tmp
sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
sudo systemctl enable amazon-ssm-agent
sudo systemctl start amazon-ssm-agent

com.amazonaws.[region].ec2messages. com.amazonaws.[region].ssmmessages. com.amazonaws.[region].ssm

• The security group must allow inbound HTTPS (port 443) traffic from the resources in your VPC that communicate with the service.