Substrate manages VPCs for each of your environments, as documented in networking, and each of these is constructed with three public and three private subnets. The private subnets, being private, aren’t directly accessible from the Internet. And though the public subnets are, it’s recommended that the traffic they do allow directly from the public Internet be handled first by ALB, NLB, API Gateway, or the like.
We recommend that you only allow SSH traffic from the public Internet into your admin account. Conveniently, this is exactly how the Instance Factory is meant to be used. So in order to jump into your private networks via SSH, use an EC2 instance from the Instance Factory as a jump box.
Substrate takes care of peering VPCs such that your admin accounts will be able to reach all your other networks. It’s up to you, however, to configure security groups to allow access where you want to.
To allow SSH from the Instance Factory, create security group rules that allow TCP traffic on port 22 from 192.168.0.0/16. (All your admin accounts are guaranteed to use that CIDR prefix and all your service accounts are guaranteed not to.)
First, SSH into an EC2 instance from the Instance Factory using the command it gives you that looks like this:
ssh -A email@example.com
Once you’re there, you’ll be able to SSH anywhere else in any of your networks that allow SSH from the Instance Factory.
You can rewrite the SSH command generated by the Instance Factory to jump through it to your actual destination:
ssh -A -Jec2firstname.lastname@example.org destination