Which is why you enable Multi Factor Authentication beforehand and make sure the roles you assign the instances you create don't have write access except for the one bastion, which you make sure doesn't have root login or even access to the public internet except for your IP but still have access to your private servers via VPCs.