As AWS Security groups can enable you to permit a particular IP or explicit range of IPs for SSH inbound, it's quite pointless having a Bastion Host for this use case. The Docs teach you how to do this.
The only time you'd want a Bastion Host on AWS is that if you need to SSH into instances that are in a private subnet. To get at instances in a private subnet from the internet, you need to SSH into an instance in a public subnet, and from that bastion instance, you would need to SSH to your instance in the private subnet using its private IP.
It's pretty simple to set up. You don't need any fancy AMIs or anything like that and it only really needs to be something small like a t2.micro. Just Launch any instance eg. Amazon Linux in a public subnet. Make sure it's security group allows your IP on port 22, and SSH into it. Then you will need to permit the bastion host access to your required instances with security groups.
Once you have got this created, you can SSH into your bastion, and from there you can simply SSH into your desired instance.
Check out these links:
However, in a different way around accessing instances in a private Subnet is to line up a VPN.
But the best way to lock down your instances is to use security groups and only allow your desired IPs to your instances.
Back