Add private EC2 + SSM reverse-tunnel port-forwarding demo

[devin-ai-integration]

Summary

A minimal, self-contained demo (demos/ssm-private-ec2-port-forwarding/) that shows how to SSH into an EC2 instance with no public IP, no IGW route, and no NAT — reachable only through the SSM agent's outbound "reverse tunnel."

The instance registers with SSM over interface VPC endpoints (ssm, ssmmessages, ec2messages). We then use aws ssm start-session --document-name AWS-StartPortForwardingSession to forward a local port to :22 and ssh back down that same tunnel. The security group opens no inbound SSH (only 443 from within the VPC for the endpoints), and the route table has only the local route.

Why endpoints instead of an IGW: an instance with no public IP can't reach the internet via an IGW (that needs a public IP or a NAT), so interface endpoints keep it fully private while SSM still works — which is what showcases the reverse tunnel.

Contents

File	Purpose
provision.sh	Create VPC, private subnet (public-IP auto-assign off), SG (443-from-VPC only), the 3 SSM interface endpoints, an imported key pair, and a no-public-IP instance with an SSM instance profile (creates EC2-SSM-InstanceProfile if absent). Polls until SSM PingStatus=Online.
connect.sh	Open the port-forward session and ssh through it: ./connect.sh 'hostname && id' or interactive.
teardown.sh	Delete everything tagged Project=ssm-portfwd-demo.

Usage:

export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_REGION=us-east-2
./provision.sh
./connect.sh 'hostname && id'
./teardown.sh

Verified live

Provisioned end-to-end in us-east-2 and ran connect.sh against it:

• instance had only a private IP (10.0.1.x), public-ipv4 metadata returned 404
• outbound internet check timed out (no egress path)
• SSH over the port-forward succeeded and returned the remote hostname/user

Non-secret resource IDs are written to a git-ignored .demo-state; the SSH key is generated under ~/.ssh/ and never committed.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/1e4fab88782f4400942ce831029d2cd6
Requested by: @bsmitches

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring