Managing Outbound Security Groups for Bastion Host

Since Bastion Host outbound security group need to be locked down (i.e. no internet access), consider implementing a forward proxy (e.g. Squid) in order to filter access to certain whitelisted sites like Amazon APIs

AWS Private Link / VPC Interface Endpoints is another option if AWS APIs need to be accessed without going through the Internet. However, it is not free – cost per interface endpoint. For SSM to manage EC2 it requires a minimum of 2 endpoints and if there are multiple VPCs we need to multiply that.