There're many ways to access its EC2 instances as we know and if you want let the users access the instance only through AWS Console, then you might want to use AWS SSM (System manager), which will allow the user access only the authorised EC2 instances without Bstion host by the given IAM policy.
Here's instruction that you can consider as below:
The image versions are defined in task definition, so you'll have to create a new task definition (or update the existing one) changing the Docker image tag.
See AWS docs for a task definition template.
On a common linux instances the user are authenticated against /etc/passwd, because YOU SPECIFICALLY ASK for this behavior.
For example, when I install vsftpd, I can see a new file created under /etc/pam.d
# Standard behaviour for ftpd(8).
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed