Tailscale ate my network (and I love it)
I've never used Tailscale, but I want to highlight specifically for working with AWS, you could consider using AWS Systems Manager to access machines that are in private VPCs[1][2].  This has the advantage of reusing the same credentials used already for AWS, as well as being able to further restrict exactly what can be done with them.[1]: https://aws.amazon.com/premiumsupport/knowledge-center/syste...
[2]: https://medium.com/hackernoon/ditch-your-ssh-keys-and-enable...