To be honest, we have moved to SSM for the most part and were more using Teleport for accessing RDS and other VPC-internal endpoints, so I guess a bastion host rather than jump host is probably closer to what we'll end up needing.

Tailscale definitely works a lot better from a pricing perspective and I like how they've put SSO in their premium pricing rather than enterprise, with SCIM being used for enterprise market segmentation instead.

That being said, AWS SSM to a bastion host, then using IAM auth for RDS and EKS will probably do most of what we need. Slightly more effort, but not so much more that it's a deal breaker.