A genuine question on this topic, does that mean we should have SSH ports open to the world too? If we have some form of 2FA? Or I’m misreading the point of beyond Corp.
I think the second most secure way to handle service authentication is to protect your ports with strong auth, like this article talks about.
But the most secure way to handle this is to just eliminate the open port entirely.
Here's another post of mine where I talk about making a bastion host with no open ports and no ingress on its security group: https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index...