There are times where, in order to do some debugging or perhaps a manual migration, I need to copy large chunks of data from one EC2 instance to another. When the size of the data is tiny, it's simple enough to just scp from instance A to my machine and then scp to instance B, but for large payloads that's unsustainable.
My current approach of logging into AWS instances is through SSH over an OpenVPN tunnel. My OS user on EC2 machines doesn't really have the option of ssh from one machine to another.
I have a couple of options here. I could generate an SSH key used just to ssh from one machine to another. Or perhaps I could enable password-based login only within the subnet of the instances (not sure that's even doable). Neither sound particularly appealing or safe.
What's the best practice in this situation? I'm sure I'm not the first one to need to enable something like this.