Guides

How to SSH into a Private EC2 Instance Through a Bastion Host (Jump Server)

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

To SSH into a private EC2 instance, go through a bastion host (jump server) in a public subnet, without copying your key to it. On your laptop run ssh-add mykey.pem, then ssh -J ec2-user@<BASTION_PUBLIC_IP> ec2-user@<PRIVATE_IP>. The private instance's security group must allow SSH (22) only from the bastion's security group, and the bastion's security group allows 22 only from your IP.

chmod 400 mykey.pem                          # macOS/Linux: the key must be private
ssh-add mykey.pem                            # load the key into the SSH agent
ssh -J ec2-user@<BASTION_PUBLIC_IP> ec2-user@10.0.2.10

ssh -A ec2-user@<BASTION_PUBLIC_IP>
ssh ec2-user@10.0.2.10                       # run on the bastion; the key stays on your laptop

What do I need before connecting?

• A VPC with a public subnet (bastion) and a private subnet (target). See Public vs private subnet.
• Two instances launched with the same key pair (or two keys, both loaded with ssh-add).
• Security groups:

• The SSH agent running: on macOS and Linux it usually is; on Windows start it once in an admin PowerShell with Get-Service ssh-agent | Set-Service -StartupType Automatic; Start-Service ssh-agent.

How does SSH through a bastion work?

With ssh -J, your laptop opens an SSH connection to the bastion and, through it, a second SSH connection to the private server. Both logins are checked with the key held by the agent on your laptop; the bastion only passes the encrypted traffic along. Nothing secret is stored on the bastion.

How do I SSH into a private instance step by step?

Step 1 — Load your key into the agent

chmod 400 mykey.pem
ssh-add mykey.pem
ssh-add -l            # lists the loaded key

Step 2 — Jump with ProxyJump (-J)

ssh -J ec2-user@192.0.2.10 ec2-user@10.0.2.10

Replace 192.0.2.10 (a documentation example address) with the bastion's public IP and 10.0.2.10 with the private instance's private IP (EC2 console → instance → Private IPv4 addresses). Note: an -i mykey.pem option on this command applies only to the final server, not to the bastion — that is why we use ssh-add.

Step 3 — Save it in ~/.ssh/config (optional, recommended)

Host bastion
    HostName 192.0.2.10
    User ec2-user
    IdentityFile ~/keys/mykey.pem

Host app
    HostName 10.0.2.10
    User ec2-user
    IdentityFile ~/keys/mykey.pem
    ProxyJump bastion

Now ssh app is enough. Each host uses its own IdentityFile, so here ssh-add is not even required.

Step 4 — Or use agent forwarding (-A)

ssh -A ec2-user@192.0.2.10
ssh ec2-user@10.0.2.10

-A forwards the agent, so the second ssh on the bastion can use the key that lives on your laptop. Use it only with bastions you trust, because an administrator of the bastion could use your forwarded agent while you are connected. ssh -J avoids that and is the better default. 🔑

How do I fix bastion SSH errors?

Ghabru naka 😅 — these are the usual ones:

Is there a way without a bastion?

Yes: AWS Systems Manager Session Manager opens a shell from the console or CLI with no inbound port 22 at all. The instance needs the SSM Agent (preinstalled on Amazon Linux 2023), an IAM role with the AmazonSSMManagedInstanceCore policy, and a way to reach the SSM service (a NAT gateway or VPC endpoints). EC2 Instance Connect Endpoint is another bastion-free option. The bastion is still worth learning: it is common in companies and in interviews.