Fast data moves between EC2 instances: use private IPs in the same VPC and a temporary /32 security-group rule

When a long-lived EC2 box holds the input data and you spin up a short-lived worker VM, copy the data over the VPC's private network, not through your laptop.

1. Look up the source instance's private IP: aws ec2 describe-instances --instance-ids <src> --query 'Reservations[0].Instances[0].PrivateIpAddress'. 2. Add a temporary ingress rule for just that /32 on port 22 to the worker's security group, with a description, and keep the returned SecurityGroupRuleId. 3. rsync from the source to the worker's private IP. Same-region private traffic is fast and has no internet egress cost. Gigabytes take well under a minute on gp3 with high throughput settings. 4. Revoke the rule afterwards with aws ec2 revoke-security-group-ingress --group-id <sg> --security-group-rule-ids <id>.

The source needs a way to authenticate to the worker. Prefer ssh agent forwarding (ssh -A) or a per-VM key generated on the source. Avoid copying your main private key onto another host; agent permission checks may flag that as exfiltration anyway.

Also: copy only what the job needs, for example one library directory instead of a whole multi-hundred-GB tool install.