Launch an EC2 instance as you normally would for any other instance.

Apply OS hardening as required.

Set up the appropriate security groups (SG).

Implement either SSH-agent forwarding (Linux connectivity) or Remote Desktop Gateway (Windows connectivity).

Deploy an AWS bastion host in each of the Availability Zones you’re using.

The NAT instances in the public subnet is used to route the traffic to the instance sitting in the private subnet.