If the customer does not wish to grant SSH access to all IPs, they may instaed grant SSH access to the following ranges:

• 4.71.186.128/25
• 4.35.16.128/25

Additionally, we should describe what we do with this SSH access. Once the EC2 Instance has been started using the AWS API, MMS logs into the instance using SSH and:

• Configures the disk partitions as specified by the user
• Installs critical security patches
• Installs the Automation Agent

I think it might be nice to add this information here https://docs.mms.mongodb.com/tutorial/configure-aws-settings/ , as well as in an FAQ.