AWS's (poorly named) SSM Session Manager service already allows that.

https://docs.aws.amazon.com/systems-manager/latest/userguide...