We use a gateway box that's the only machine in the cluster serving ssh to the public and jump to our other machines from there. Why would you build it any other way?
I agree with the point of your comment - allowing SSH from the public internet is not a good idea. However, there is nothing about this script that assumes SSH is publicly available - you could even run this script on your bastion host.
I'm also planning to add an option to use the private IP of the instance so it works seamlessly when you are on a VPN connection linking you to a VPC.
Needless to say, a number of boxes, both our own and belonging to our clients) ended up as C&C machines for various botnets and I learned a very valuable lesson about how to treat a machine serving ssh to the public internet (namely: don't listen to a boss who doesn't know wtf they're talking about with regards to security, don't allow password ssh logins _ever_, for fuck's sake don't serve ssh to the public internet if you don't absolutely have to, and bloody hell denyhosts!).
The headaches of dealing with pwned machines that were critical to the business in question while I was being paid 30k/year very much colored my opinion of how to handle ssh.
Obviously I quit that job as soon as I had a credible alternative and was able to double my salary twice in two years (amazing what you can do once you know what you're actually worth on the market).
I'm primarily a developer now, but do share some infrastructure management responsibility at the small (9 person) startup where I work now. Aws and opsworks has enabled us to run without a dedicated ops team, and I'm the most security paranoid person on the engineering team.