We use symops[0] to connect to our servers. Not sure about the implementation details, but the gist is that we connect through our aws credentials (via SSM), which we retrieve using Okta, which is then protected using 2fa. No ssh key to be found, and you can disable all ssh ingress rules. Since this is via SSM, you can also use the full power of AWS IAM to allow/deny access.

Also, Sym can be set up to require approvals too which is great for security auditing since it's a third party.

[0] https://symops.com/