I have an AWS VPC with a public and private subnet. The public subnet has 1 EC2 instance and the private subnet also has 1 EC2 instance. If I do a site to site VPN from my work site to the VPC. Can I ssh into the private subnet EC2 instance using the private ip? Or do I have to do a Bastian host to access the private subnet EC2 instance.