On the Ec2 side security groups can be used to only allow access for the company IP. Then VPN can be used to secure connections from coffee houses back the the office.