Reach the Studio privately

Opening port 8501 is the simplest way in, but the traffic is plain HTTP. If you would rather keep port 8501 closed, or you work on networks you do not trust, reach the Studio through an encrypted tunnel instead. Either way you then open http://localhost:8501 on your own computer.

Over SSHOver Session Manager

Only port 22 needs to be open:

ssh -i <key>.pem -L 8501:localhost:8501 ubuntu@<public-ip>

No inbound ports at all. Needs the IAM role from Connect to your instance, plus the AWS CLI and its Session Manager plugin on your computer:

aws ssm start-session --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["8501"],"localPortNumber":["8501"]}'

Once you use a tunnel, you can remove the port 8501 rule from the security group.

Turning the password off

If nobody can reach port 8501 from the network, turning the password off with sudo sushi-ml-studio disable-password is reasonable. Do not turn it off while the port is open to the internet.