Forem: Saumil343

Gen-AI Powered Healthcare Queries with AWS Kendra & Bedrock

Saumil343 — Thu, 02 Jan 2025 15:53:27 +0000

Introduction

In the healthcare industry, having accurate and contextually relevant information readily accessible is crucial for clinicians, patients, and administrative staff. Simple keyword-based searches can often fall short, offering information that lacks the specificity and depth required in a clinical setting. To address this, a solution was developed using AWS Kendra for intelligent search and AWS Bedrock for generative AI, enabling healthcare clients to receive not only relevant information but also enhanced, context-sensitive responses.

Business Problem

Healthcare professionals and patients frequently seek precise answers to complex medical questions. Standard keyword-based search systems may retrieve general documents but often lack the contextual accuracy needed in critical medical situations. Moreover, clinicians often require enhanced responses that go beyond straightforward answers to provide additional insights. This solution addresses these challenges by combining Kendra’s reliable document retrieval capabilities with Bedrock’s generative AI model to deliver well-rounded, contextually aware responses.

Solution Overview

This healthcare-focused solution integrates two powerful AWS tools:

AWS Kendra: Acts as the primary search engine, retrieving high-precision information from reliable medical documents based on user queries. Kendra enables clinicians and patients to access the exact information they need without time-consuming manual searches.
AWS Bedrock (Gen-AI): Adds depth and clarity to Kendra’s responses by generating enhanced, context-sensitive answers. Bedrock’s language generation capabilities allow for tailored responses that vary in complexity to suit different audiences, from healthcare professionals to patients.

The solution uses Python to integrate these services, ensuring smooth communication and data processing across both AWS tools and enabling scalability for diverse healthcare applications.

Technical Implementation

This implementation involves the following steps:

1. AWS Kendra Query for Information Retrieval

A Kendra client is initialized with the designated AWS region and index ID.

The user’s query text (e.g., “What are the warning signs for DKA?”) is sent to Kendra, which retrieves relevant medical information.
Result Parsing: The response items from Kendra are filtered to extract the most relevant answer (e.g., through Highlights attributes) to be used for further processing.

Creating a Kendra index:

Adding a data source to Kendra:

2. Enhanced Response Generation with AWS Bedrock

The Blog utilizes ‘amazon.titan-text-lite-v1’ bedrock model.
A Bedrock client is invoked to generate an enriched, context-sensitive answer based on Kendra’s initial response.
The context and original question are structured into a prompt format to enhance Bedrock’s generative model’s output.
Generative Configuration: Parameters such as temperature and maxTokenCount are optimized to balance response thoroughness and relevancy.
Bedrock then generates an enhanced response, adding additional clarity, context, and suggestions that make the information suitable for healthcare decision-making.

3. Python application:

Code repo : Github-repo

import boto3
import json

# AWS region setup
region_name = 'us-east-1'

# Initialize Kendra client
kendra = boto3.client('kendra', region_name=region_name)
index_id = 'kendra-index-id-here'
query = "what are the warning signs for DKA? "

# Initialize Bedrock client
boto3_bedrock = boto3.client('bedrock-runtime', region_name=region_name)

# Function to invoke Bedrock for enhanced response
def get_bedrock_enhanced_response(human_input, context_string):
    prompt_data = f"Here is some context:\n\n{context_string}\n\nHuman: {human_input}\nAssistant:"

    body_part = json.dumps({
        'inputText': prompt_data,
        'textGenerationConfig': {
            'maxTokenCount': 4096,  # Corrected maxTokenCount to be within the allowed range
            'stopSequences': [],
            'temperature': 0.7,  # Adjust as needed
            'topP': 1.0
        }
    })

    # Invoke Bedrock model
    response = boto3_bedrock.invoke_model(
        body=body_part,
        contentType="application/json",
        accept="application/json",
        modelId='amazon.titan-text-lite-v1'  # Bedrock model ID
    )

    # Read and decode the StreamingBody before parsing
    response_body = response['body'].read().decode('utf-8')
    output_text = json.loads(response_body)['results'][0]['outputText']
    return output_text

# Kendra query processing
response = kendra.query(QueryText=query, IndexId=index_id)

# Process Kendra query results
for query_result in response['ResultItems']:
    begin = 0
    end = 0
    if query_result['Type'] == 'ANSWER':
        answer = query_result['AdditionalAttributes'][0]['Value']['TextWithHighlightsValue']
        highlight = answer['Highlights']
        for obj in highlight:
            if obj['TopAnswer'] is True:
                begin = obj['BeginOffset']
                end = obj['EndOffset']

        # Get the answer text
        if end == 0:
            answer_text = answer['Text']
        else:
            answer_text = answer['Text'][begin:end]

        print("Kendra Answer: ", answer_text)

        # Now pass the Kendra response to Bedrock for enhancement
        enhanced_response = get_bedrock_enhanced_response(query, answer_text)
        print("\nEnhanced response from Bedrock:\n")
        print(enhanced_response)

Use Case Example

A practical use case for this solution is illustrated with a query about diabetic ketoacidosis (DKA), a critical condition requiring timely recognition:

1. User Query: A clinician asks, “What are the warning signs for DKA?”

2. Kendra Response: AWS Kendra retrieves a concise answer from a document stored in S3, such as “DKA symptoms include excessive thirst, frequent urination, nausea, and fatigue.”

3. Enhanced Response via Bedrock: Bedrock processes this response, adding further context, such as explaining symptoms in layperson’s terms and suggesting next steps for patients. For instance, “Warning signs for DKA, a complication from high blood sugar, include extreme thirst, frequent urination, nausea, and fatigue. If these symptoms occur, patients should seek medical attention promptly to avoid severe complications.”

This example demonstrates the combined power of Kendra and Bedrock to provide healthcare professionals with accurate, contextually enhanced answers that are easy to interpret for both patients and clinicians.

Results

The integration of AWS Kendra and Bedrock provides several key benefits for healthcare clients:

- Enhanced Information Relevance: Kendra’s retrieval of information ensures answers are precise and sourced from credible healthcare documents from S3.

- Clarity and Contextual Depth: Bedrock’s generative capabilities add context to complex medical terms, making information accessible and understandable.

- Efficiency and Time Savings: The solution minimizes the time clinicians spend searching for answers, supporting quicker decision-making and patient interactions.

These outcomes improve the quality of healthcare information retrieval, ensuring that professionals and patients alike receive actionable, high-quality responses.

Conclusion
This AWS Kendra and Bedrock solution demonstrates a robust use case for healthcare clients seeking reliable, context-rich information to enhance clinical decision-making and patient care. With Kendra’s precision search capabilities and Bedrock’s advanced language generation, the architecture provides accurate, well-rounded responses tailored to healthcare needs. This solution is highly scalable, adaptable, and effective for various healthcare applications, making it a valuable tool in the evolving landscape of healthcare information technology.

AWS Backup Mastery: Navigating Cross-Account, Cross-Regional Immutable Backups for RDS with Practical Ease

Saumil343 — Sun, 10 Nov 2024 17:14:28 +0000

Introduction:
In the realm of tech, data safety is non-negotiable, and AWS Backup emerges as the superhero in this narrative. This blog unlocks the perks of savvy backups, spanning different accounts and regions, ensuring the fortification of your data. This blog begins by addressing a quirk—certain AWS services, like RDS, can't execute backups across accounts and regions simultaneously. No sweat! This blog will walk you through a step-by-step plan. First, let's set up cross-regional backups to lay a solid foundation. Once that's nailed, this blog will guide you on extending this safety net across different AWS accounts, giving your data a superhero cape ready for any digital challenge.

Considerations

Primary region: us-east-1
Backup region: us-east-2
Retention in backup account: 30 days [Customizable in Python Lambda code]

Step-by-step guide:

1. Create a Backup Vault in Backup Account (Backup Region)

Establish a vault for storing immutable backups, a secure haven for your critical data.

2. Set up an Immutable Vault Lock

Secure your vault by implementing an immutable vault lock, adding an extra layer of protection against accidental modifications or deletions.

3. Create a KMS-CMK in Workload Account (Backup Region)
Generate a Key Management Service (KMS) key with a 'Single region & Symmetric key' configuration, enhancing data security in your workload account, which is shared with backup account for seamless transmission of backups from workload account to backup account.

Key Policy for KMS key

{ 

    "Id": "key-consolepolicy-3", 

    "Version": "2012-10-17", 

    "Statement": [ 

        { 

            "Sid": "Enable IAM User Permissions", 

            "Effect": "Allow", 

            "Principal": { 

                "AWS": "arn:aws:iam::{workload-account-number}:root" 

            }, 

            "Action": "kms:*", 

            "Resource": "*" 

        }, 

        { 

            "Sid": "Allow use of the key", 

            "Effect": "Allow", 

            "Principal": { 

                "AWS": ["arn:aws:iam::{backup-account-number}:root","arn:aws:iam::{workload-account-number}:root"] 

            }, 

            "Action": [ 

                "kms:Encrypt", 

                "kms:Decrypt", 

                "kms:ReEncrypt*", 

                "kms:GenerateDataKey*", 

                "kms:DescribeKey" 

            ], 

            "Resource": "*" 

        }, 

        { 

            "Sid": "Allow attachment of persistent resources", 

            "Effect": "Allow", 

            "Principal": { 

                "AWS": ["arn:aws:iam::{backup-account-number}:root","arn:aws:iam::{workload-account-number}:root"] 

            }, 

            "Action": [ 

                "kms:CreateGrant", 

                "kms:ListGrants", 

                "kms:RevokeGrant" 

            ], 

            "Resource": "*", 

            "Condition": { 

                "Bool": { 

                    "kms:GrantIsForAWSResource": "true" 

                } 

            } 

        } 
]

4. Create Backup Vault in Workload Account (Backup Region)

Establish a backup vault in the workload account, utilizing the KMS key created in the previous step to ensure a secure backup environment.

5. Set Up Backup Vaults in Primary Region (Workload Account)

Create backup vaults in the primary, laying the groundwork for efficient data backup and recovery.

6. Create a Backup Plan for RDS in Workload Account
Develop a backup plan with a daily frequency set for 8 pm IST, ensuring a consistent and reliable backup schedule for your RDS instances.

Backup window configuration:

7. Copy Configuration to Intermediate Vault

Configure copy settings to an intermediate vault in the backup region, streamlining the process of moving backups between regions.

8. Add Crucial Tags
Enhance backup management by adding tags; a key tag to include is 'FinalVault' with a value representing the ARN of the backup vault in the backup account in the backup region.

9. Create Lambda Function in Workload Account (Backup Region)
Implement a Lambda function using any runtime environment to automate AWS Backup copy jobs, enhancing the efficiency of your backup strategy, the lambda function would be responsible for initiating a copy job from secondary region of workload account to backup account.

import  boto3 

def lambda_handler(event, context): 

    # Main lambda function to invoke AWS Backup copy job 

    try:     

        eventDetail = event.get('detail') 

        if eventDetail: 

            #Fetching parameters from event 

            jobState = eventDetail.get('state') 

            destinationBackupVaultArn = eventDetail.get('destinationBackupVaultArn') 

            iamRoleArn = eventDetail.get('iamRoleArn') 

            backupVaultName = destinationBackupVaultArn.split(':')[-1] 

            destinationRecoveryPointArn = eventDetail.get('destinationRecoveryPointArn') 



        if 'COMPLETED' == jobState: # Ensuring the config work on 'COMPLETE'  

            backup_client = boto3.client('backup') 

            response = backup_client.list_tags(ResourceArn=destinationRecoveryPointArn) 

            tag_list = response.get('Tags') 

            print(f'tag_list from Copy Job :{tag_list}') 

            for key in tag_list: 

                # Feteching tag from recovery points, to identify and copy RDS to final vault 

                if key.lower() == 'FinalVault'.lower(): 

                    destinationVaultArn = tag_list[key] 

                    print(f'Copying {destinationRecoveryPointArn} to {destinationVaultArn} from {backupVaultName}') 



                    #Initiating a copy job from intermediate to final vault 

                    response = backup_client.start_copy_job( 

                        RecoveryPointArn=destinationRecoveryPointArn, 

                        SourceBackupVaultName=backupVaultName, 

                        DestinationBackupVaultArn=destinationVaultArn, 

                        IamRoleArn=iamRoleArn, 

                        # Retention period for final recovery point 

                        Lifecycle={ 

                            'DeleteAfterDays': 30 

                        }) 

                    print(f'start_copy_job done : {response}') 

                 

    except Exception as e: 

      print(e)

10. Create EventBridge Rule in Workload Account (Backup Region)
Develop an EventBridge rule to trigger the Lambda function upon completion of a copy job, enhancing automation and responsiveness, don’t forget to update the backup plan id in below code with newly created backup plan.

Event Pattern:

{ 

    "source": ["aws.backup"], 

    "detail-type": ["Copy Job State Change"], 

    "detail": { 

      "createdBy": { 

        "backupPlanId": ["6d0fefcf-t4a4-46c2-9d87-770c506f4e54"] 

      } 

    } 

  }

11. Add Resource-Based Policy to Lambda Function
Strengthen Lambda function security by adding a resource-based policy, allowing the EventBridge rule to invoke it seamlessly.

12. Create EventBridge Rule in Workload Account (Primary Region)

Establish a second EventBridge rule in the primary region to trigger the EventBridge rule in the backup region upon completion of a copy job, don’t forget to update the backup plan id in below code with newly created backup plan.

Event Pattern:

{ 

    "source": ["aws.backup"], 

    "detail-type": ["Copy Job State Change"], 

    "detail": { 

      "createdBy": { 

        "backupPlanId": ["6d0fefcf-t4a4-46c2-9d87-770c506f4e54"] 

      } 

    } 

  }

Final flourish for security and management

You can utilize AWS organization to manage the backups.
SCPs can be used to enhance the security of backups.
Least previledged IAM role with IAM policies should be used for backup plan, lambda function.

Conclusion
By following these steps, you'll successfully implement a robust cross-account, cross-regional immutable backup solution for your RDS instances using AWS Backup, ensuring the safety and integrity of your critical data.

AWS Backup: The Cornerstone of Data Resilience

Saumil343 — Mon, 25 Sep 2023 13:16:04 +0000

Author
Saumil Shah

In the ever-evolving digital landscape, where data is the lifeblood of businesses and organizations, the concept of data backup has become paramount. In essence, a backup is a secure and duplicate copy of your critical data and information. This copy is stored separately from your primary data source, ensuring that in the face of unexpected calamities, data corruption, or cyberattacks, your valuable information remains intact and recoverable. A well-implemented backup strategy is akin to a safety net for your digital assets, providing you with the assurance that, even in the worst-case scenarios, your data can be resurrected, and business operations can continue with minimal disruption.
With that to say disaster recovery (DR) planning is essential for business continuity. Disasters, whether natural or digital, can strike without warning, leading to data loss and downtime. Backups are at the heart of an effective DR strategy, enabling rapid data recovery. They are crucial for maintaining operations, preserving trust, and preventing financial losses. This blog will guide you through AWS Backup, a service that reinforces the core concept of data 'Backup'.

What is AWS Backup Service and Why It Matters
AWS Backup is a fully managed data backup and recovery service offered by Amazon Web Services (AWS). It provides a centralized and streamlined solution for safeguarding your data across various AWS resources and services. AWS Backup is designed to simplify the backup process, making it easier to create, manage, and restore backups for critical data.

Key Components of AWS Backup Service
AWS Backup comprises several vital components that collectively provide a robust data protection and recovery solution:

1. Backup Vaults:
Vaults are logical containers that help you organize and manage your backups effectively. You can create multiple vaults to categorize and store backups based on your requirements.

2. Backup Plans:
These are at the heart of AWS Backup and define your backup policies and schedules. Within a backup plan, you specify settings such as backup frequency, retention periods, and lifecycle rules.

3. Resource Assignments
Resource assignments link your AWS resources, such as EC2 instances or RDS databases, to specific backup plans. This ensures that your resources are protected according to the defined policies, which also supports TAG based resource selections.

4. Backup Jobs
Backup jobs are the operational processes responsible for creating backups of your resources. They run according to the schedules you've set in your backup plans and capture the data for safekeeping.

5. Recovery Points
These are specific states of your resources captured by backup jobs at particular points in time. AWS Backup retains multiple recovery points based on the retention settings in your backup plan.

6. Lifecycle Rules
Lifecycle rules determine the retention period of your backups and when they should be deleted. You can configure rules to automatically transition backups to cold storage or remove them when they're no longer needed.

7. Vault Lock
Vault lock provides an additional layer of security for your backups. When enabled, it prevents the deletion of backup data for a specified retention period, ensuring data integrity and compliance with retention policies.

Key features of backup service
The importance of AWS Backup cannot be overstated in today's data-driven world. Here are some key reasons why it matters,

Data Resilience: Data loss can be catastrophic for any organization. AWS Backup ensures that your critical data is protected and can be quickly recovered in case of accidental deletions, hardware failures, or data corruption.

Security and Compliance: AWS Backup integrates with AWS Identity and Access Management (IAM) and AWS Key Management Service (KMS) to provide secure, encrypted backups. This is crucial for meeting regulatory requirements and maintaining data privacy.

Simplicity and Automation: AWS Backup simplifies the backup process with automated policies, making it easy to create, schedule, and manage backups without the need for complex scripting or manual interventions.

Centralized Management: With AWS Backup, you can manage backups for multiple AWS services from a single console, streamlining backup operations and reducing management overhead.

Cross-Region and Cross-Account Backups: AWS Backup enables you to create backups that span regions and AWS accounts, enhancing data resilience and disaster recovery capabilities.

Importance of Cross-Account and Cross-Regional Backups
Cross-account and cross-regional backups form the cornerstone of a resilient data protection strategy. In today's distributed computing landscape, where organizations operate across multiple AWS accounts and regions, ensuring data availability and recoverability is paramount.
Cross-account backups involve replicating critical data from one AWS account to another, mitigating the risk of accidental data loss and enhancing security by adhering to the principle of least privilege. Cross-regional backups extend this protection by replicating data across different AWS regions, guarding against region-specific outages or unforeseen disruptions. Together, these practices fortify data resiliency, reducing downtime and safeguarding data integrity in the face of evolving threats.
Benefits of cross-account and cross-regional backups

Enhanced Security Control
Reduced Risk of Data Loss
Data Isolation
Compliance Benefits
Geographic Redundancy
Enhanced Resilience

Combining cross-account and cross-regional backups offers a comprehensive data protection solution that not only secures your data against threats but also ensures its availability, even in challenging scenarios.

Guide to Achieve Immutable Backups

Key security layers which contribute to immutability of backup

1. Least privilege access through IAM policies
Least privilege access on both backup and workload account to a limited set of users can prevent unauthorized access to backups.

2. Service control policies on both workload account & backup account
Service control policies (SCPs) further restricts the access to backup service and backup account to strengthen the security of backups.

3. Backup Vault lock on backup account
Backup vault lock ‘Compliance Mode’ ensures that No-one including even AWS cannot delete the recovery points which are stored in backup vault of backup account.

4. Encryption of backups through isolated KMS-CMK.
KMS key which is used along with the backup vault encrypts the backups thus there is no direct vulnerable open data which can be used.

5.Audit & monitoring through backup audit manager & cloud trail events
Active monitoring and logging of backup jobs can be done via audit manager, with that cloudtrail events can be used to notify the admins if there are specific actions performed on backup service.

In summary, AWS Backup is a crucial service for modern businesses, offering simplified and centralized data backup solutions. It ensures data resilience, security, and compliance through features like cross-account and cross-regional backups, immutable backups, and encryption. With AWS Backup, organizations can protect their critical data, reduce downtime, and enhance data integrity in today's rapidly evolving digital landscape.

In Collaboration with,
@piyush_jalan

Automated S3 Security: Lambda Functions to the Rescue!

Saumil343 — Tue, 15 Aug 2023 07:59:59 +0000

Author
Saumil Shah

ABSTRACT:
In today's business landscape, the widespread migration of workloads to the cloud has become a norm, with S3 playing a crucial role as a key solution for effective data storage and retrieval. Further, ensuring the security of S3 buckets becomes paramount. In this technical blog, we will explore an automated approach to enhance the security of S3 buckets using AWS Lambda. By leveraging CloudTrail events and Lambda functions, we can detect and remediate common security issues related to S3 public access block.

POTENTIAL SECURITY THREATS OF S3
Amazon S3 is widely used for static website hosting, providing scalability and cost-effectiveness. However, disabling the public access block exposes security threats. Without the block, misconfigurations or errors in permissions can lead to unintended public access, potentially exposing sensitive information. Unauthorized listing of bucket contents becomes possible, giving attackers insights for further exploitation.

SECURITY RISK OF S3:
• Disabling the public access block exposes security threats
• Misconfigurations or errors in permissions can lead to unintended public access
• Unauthorized listing of bucket contents becomes possible, enabling further exploitation
• Inadvertent changes to block settings can bypass security measures
• Failure to enforce encryption increases the risk of exposing sensitive data at rest
• Misconfigured access control policies may allow unauthorized public access

Thus, Regular security audits are essential to identify changes or misconfigurations. Inadequate auditing could lead to undetected vulnerabilities. To reduce the risk of these threats, it is essential to have an automated system that regularly checks the environment to ensure that critical controls are enabled for the specific use case.

AUTOMATED SECURITY REMEDIATION WITH LAMBDA AND EVENT BRIDGE

Let's explore a practical example of restricting public access to S3 buckets.
Here is the architecture we will be implementing to address the issue at hand.

The lambda function is designed to be triggered by the ‘CreateBucket’ event in CloudTrail. Its purpose is to block public access for S3 buckets that do not have a specific tag. The tag, with the key "hosting" and the value "web," is crucial for identifying buckets which are used for static website hosting or not. By filtering based on this tag, we can ensure that blocking public access only applies to the appropriate buckets.
To begin the implementation, we will create an Event Bridge rule, which will be used for invoking a Lambda Function.

Step 1: Create below Lambda Function with Python runtime:

import boto3

def lambda_handler(event, context):
    s3 = boto3.client('s3')

    # Get all the S3 buckets
    response = s3.list_buckets()
    buckets = response['Buckets']

    # Iterate through each bucket
    for bucket in buckets:
        bucket_name = bucket['Name']
        try:
            # Get the bucket tags
            response = s3.get_bucket_tagging(Bucket=bucket_name)
            if 'TagSet' in response:
                tags = response['TagSet']

                # Check if the bucket has the required tag
                has_hosting_tag = any(tag['Key'] == 'hosting' and tag['Value'] == 'web' for tag in tags)

                # If bucket does not have the required tag, block public access
                if not has_hosting_tag:
                    s3.put_public_access_block(
                        Bucket=bucket_name,
                        PublicAccessBlockConfiguration={
                            'BlockPublicAcls': True,
                            'IgnorePublicAcls': True,
                            'BlockPublicPolicy': True,
                            'RestrictPublicBuckets': True
                        }
                    )

        except:
            # Handle exception
            print("TagSet not ")


    return {
        'statusCode': 200,
        'body': 'Public access blocked for buckets without the "hosting:web" tag'
    }

Step 2: Create the below event bridge rule with custom pattern:

1) Go to EventBridge console, create a new rule, and select rule type as event pattern:

2) In build event pattern keep everything default except ‘Creation Method’ select Custom pattern (JSON editor) in that place the event JSON code

{    
    "source": ["aws.s3"],
    "detail-type": ["AWS API Call via CloudTrail"],
    "detail": {
      "eventSource": ["s3.amazonaws.com"],
      "eventName": ["CreateBucket"]
    }
}

3) Select target as the Lambda function which was created in step 1.

4) Review and create the event bridge rule.
Note: Ensure that there is at least one CloudTrail event running in your AWS account for successful execution of the task.

CONCLUSION
In this technical blog, we delve into an automated method that utilizes AWS Lambda to bolster the security of S3 buckets. By leveraging CloudTrail events and Lambda functions, the blog demonstrates how to identify and resolve prevalent security concerns associated with S3 public access blocks. The blog covers the creation of an EventBridge rule, which serves as the trigger for invoking a Lambda function.

CO-FIRST AUTHORS
@khushi3008
@piyush_jalan

Revolutionizing Access: No More Bastion Hosts with AWS Private Endpoint [TUTORIAL]

Saumil343 — Thu, 29 Jun 2023 06:14:36 +0000

In a significant update, Amazon Web Services (AWS) has introduced a groundbreaking feature that allows seamless connections to private instances using an endpoint. This innovative solution eliminates the need for traditional bastion hosts, simplifying and enhancing the security of SSH access to private instances. In this blog post, we will explore the step-by-step process of leveraging AWS private endpoints to establish secure SSH connections to private instances, both through the AWS console and the command-line interface (CLI).

Two Ways of Connecting: There are two convenient methods to connect to private instances using AWS private endpoints: through the AWS console or AWS instance connect, and via the CLI. We will delve into both approaches, providing you with a comprehensive guide to help you utilize this exciting new feature effectively.

Process:

1.Creating an EC2 Endpoint: To begin, we need to create an EC2 endpoint, which will serve as the entry point for establishing SSH connections to private instances. Follow these steps:
a. Navigate to the AWS Management Console and access the VPC (Virtual Private Cloud) service.

b. Within the VPC dashboard, select the "Endpoints" tab and click on the "Create Endpoint" option.

c. When creating the endpoint, ensure you select the appropriate VPC, security group, and subnet.

• The security group facilitates traffic through specific ports, enabling interaction with the security group.
• The chosen subnet ensures a private connection to that subnet with a specific SSH tunnel.

2.Creating an EC2 Instance in a Private Subnet: Now that we have set up the EC2 endpoint, we can proceed with creating an EC2 instance in a private subnet. Follow these steps:
a. Access the EC2 service through the AWS Management Console.
b. Choose the "Instance Connect" option and select the "Connect with EC2 Endpoint" feature.
c. Select the newly created EC2 endpoint from the list to establish the connection seamlessly.

3.Connecting via CLI: To leverage the power of the command-line interface (CLI) for SSH connections to private instances, follow these steps:
a. Begin by configuring the AWS CLI on your local machine.
b. Open a command prompt and execute the following command to create an SSH tunnel:

aws ec2-instance-connect open-tunnel --instance-id YOUR_INSTANCE_ID --local-port 8888
c. In a new terminal window, use the SSH command to connect to the private instance by specifying the key pair file and the tunnel port:

ssh -i key.pem ec2-user@localhost -p 8888

Conclusion: With the introduction of AWS private endpoints, the process of connecting to private instances securely has been revolutionized. By following the step-by-step guide outlined in this blog post, you can eliminate the reliance on bastion hosts and establish direct SSH connections to private instances with ease. Whether through the intuitive AWS console or the power of the CLI, AWS private endpoints empower you to simplify your infrastructure while enhancing security. Embrace this exciting new feature and experience a seamless and secure SSH access solution for your private instances on AWS.