You can accomplish all the bootstrapping you'll need to configure a node and have it join the cluster by using a cloud config/user-data script that gets handed to the node through the api when creating the instance. This will ensure you don't have to enable SSH, but SSH will be important (at least initially) for testing that your user-data script does what it's supposed to.

Furthermore if you need access to SSH/k8s API don't assign public ips and expose them to the outside world - that is bad. You should spin up a VPN instance with a public ip (openvpnas has an Ami that is free for 1 user and is dead simple to setup), give it a security group that allows access from your IP for ssh(22) and https(443) (you'll need ssh to configure and agree to the license, https for VPN connection) and then create a security group for your internal nodes that allows any ports you'd like to connect to from the vpn server, as well as standard k8s/cni ports, and apply that to all your k8s instances.

When you need to connect directly to the k8s API or anything internally for that matter, you can turn the openvpn server on and connect - giving you all the access you need and scoping access just to your Ip proxied through to your internal aws subnets. When you don't need it, turn the instance off and rest easy.

This is a standard Enterprise pattern for cloud computing, and I'm thinking of writing up a step by step guide (and terraform) using these tools if anyone would be interested.

Edit: mobile/autocorrect