There're many ways to access its EC2 instances as we know and if you want let the users access the instance only through AWS Console, then you might want to use AWS SSM (System manager), which will allow the user access only the authorised EC2 instances without Bstion host by the given IAM policy.
Here's instruction that you can consider as below:
Install and verify its SSM agent on the Windows or Linux instance. See Manually install SSM Agent on EC2 instances for Windows Server
Set a given IAM policy belong to the users or group.
Refer to Additional sample IAM policies for Session Manager.
- You can either restrict access based on instance tags or specific instances-id, Just pick one that you want to.
An example of user IAM policy as following:
- Lastly, set EC2 IAM Role for the instance with
AmazonSSMManagedInstanceCore managed policy by AWS.
Then you're good to go safely. Connecting its Windows instance on AWS Console is pretty easy. Please take a look by visitng Connect to a Windows instance using Session Manager
When a user access the EC2 via AWS console, a prompt will be appears like in the picture, and then can access if IAM Role and policy has been given properly in each instance and the users.