I need to create a single AWS EC2 instance to share some work with a collaborator who will have ssh access. My instinct was initially to lock down the instance with a VPN in addition to ssh key access. However, while looking over a tutorial to configure OpenVPN I see that the VPN server itself requires ssh access. (I have ruled out AWS VPN Client in the short term due to cost). Given this information, I don't see the point in creating a VPN for my use case; either way exactly one host is public facing with ssh access.
Am I wrong? Does hiding a single developer machine behind a VPN give more guarantees? If so, what are they?