One of the things I wanted to avoid in my AWS labs was making an instance public simply because I needed administrative access. That pushed me to work more with AWS Systems Manager Session Manager.
The access model
I keep the EC2 instance in a private subnet, attach the appropriate IAM role, and use Systems Manager instead of opening SSH from the internet. Where the instance does not have another path to AWS services, I use the SSM, EC2Messages, and SSMMessages VPC endpoints.
A troubleshooting lesson
I had a private instance that would not appear as manageable in Systems Manager. Instead of exposing SSH as a shortcut, I traced the path the SSM agent needed and found that the private connectivity was incomplete. Adding the required endpoints resolved the issue.
Why I prefer this approach
It reduces unnecessary public exposure and makes administration depend on IAM and AWS service connectivity instead of a permanently open management port. It also gives me a clearer troubleshooting model: role, agent, network path, endpoint, and service status.