Connect to Private EC2 instance

For a Windows instance located in a private subnet, there is no public IP, no internet gateway, so it cannot go out to the internet. With this type of instance, the traditional approach is to use the Bastion host technique which costs a lot of money and effort, but here we will use Session Manager for this type. Basically, the private instance still has to open port TCP 443 to Systems Manager, but it does not allow that connection to go out to the internet, only allowing it to go within its own VPC, so security is ensured. To do that, we have to bring the Systems Manager endpoint into the VPC, meaning using a VPC interface endpoint:

A VPC interface endpoint is attached to a subnet, so this approach can be done not only with a private subnet but also with a public subnet, meaning with a public subnet, you can completely prevent TCP 443 from going out to the internet.