AWS - Private EC2 - Bastion setup on MAC

This is the most secured way of connecting to Private EC2 instances from Host Computer. Even if Bastion host(Public EC2) is compromised/hacked, nobody can access Private EC2 instances. Because .pem key files are stored in Host Computer.

1)Create a VPC
2)Create a subnet
3)Subnets =>"Subnet Actions" dropdown menu ==> 'Modify auto assign IP settings'
4)Create Internet Gateway to make Subnet internet accessible.
5)Attach Internet Gateway to VPC.
6)IMPORTANT : Add an entry in VPC ==> 'Routes Table' section ==> 'Routes' tab ==> Destination (0.0.0.0/0) and Target (new Internet Gateway) ==> This step exposes Public EC2 instance to Internet and also Private EC2 can access internet, otherwise Public EC2 instance can't be accessed by outside world.
7)Create 2 Security Group - 1 for Public EC2 and 1 for Private EC2. For Private EC2 Security group ==> in Inbound Rules ==> make sure you referring Source value to Public EC2 Security group. This ensures Public EC2 Bastion hosts acts as a mediator between Private EC2 and outside world.
8)Create EC2 instance, while creating instance make sure you selecting appropriate Subnet, and select 'Disable' option in 'Auto-assign Public IP' if you want to create private EC2 instance. If you want to get an public IP(EC2 instance) leave it as default value (Use subnet settings(Enable)).
9) While creating private EC2 instance make sure you referring to appropriate 'Security Group'.
10)Connect to Public EC2 using this command:

ssh ec2-user@<publicIP> -i <pem key>

To verify whether it's connected to Internet - run this command, this updates the linux software:

yum update -y

or to Install Apache : yum install httpd -y

11) To connect to private EC2 using Bastion Host(Public EC2). Use the below settings in SSH

HOST bastion
  IdentityFile ~/.ssh/pem/mylinuxkey.pem
  User ec2-user
  Hostname 35.168.23.91

HOST 10.*
  user ec2-user
  IdentityFile ~/.ssh/pem/mylinuxkey.pem
  ProxyCommand ssh bastion -W %h:%p

Save these steps in ~/.ssh/config

And run the command as below:

ssh 10.0.1.123

==> This connects to Private EC2 using the ProxyCommand with bastion(Public EC2) details

12) To connect to S3 from private EC3, create an EndPoints in VPC section. Select Service name:com.amazonaws.us-east-1.s3 And select appropriate VPC. This configuration makes and entry to Route Tables of VPC configuration.
13) Once you login to Private EC2, enter below command to fetch a Bucket files.

aws s3 ls s3://usbastiontesting --recursive

***NOTE : Make sure S3 and VPC are in same region, otherwise we can't fetch files from other region buckets. Currently Cross region is not supported by Endpoints.