I have a web server which is running on a private subnet in AWS VPC, let us call it worker.
I can access the worker VM through a Bastion VM which is in the same VPC but in a public subnet.
Then, I have another VM (public_host) in a public subnet in a different VPC which listenning to the worker VM through SSH tunnel.
inorder to make the SSH tunnel, I need to have the private keys of Bastion and worker on the public_host. I am not security expert, but I guess it is not the best practice to have private keys on the public VM.
can someone please suggest me an approach solve this weak point?
I was thinking to write the listener with the private keys included in a Go app, then compile it and deploy the compiled binaries on the public_host. Would it be considered a more secure approach?