The current default security group for AWS clusters allows port 22 for debugging access. However, it is currently not usable by SRE because they cannot create a bastion instance in customer account. It should be removed from the default security group.