Yeah, SSM supports just opening a terminal on the remote host without ssh. We started with regular ssh bastions though so I just stuck with that. They're just no longer routeable from outside.