AWS Systems Manager provides a neat solution to do this [0], permission would be managed via IAM.

[0] https://github.com/elpy1/ssh-over-ssm <-- not made by me, but a good example