How Do I Prevent Cluster Nodes from Being Exposed to Public Networks?

If access to port 22 of a cluster node is not required, you can define a security group rule that disables access to port 22.
Do not bind an EIP to a cluster node unless necessary.

Parent topic: Security Hardening