or anything else you bootstrap after your bastion hosts that only has private ips

I assume you mean like instances?