Connect to a private EC2 instance using a bastion server or jump box
Run ssh-agent
eval $(ssh-agent)
Add the key to ssh agent
ssh-add ec2-key.pem
Connect to the public jump box with forwarding allowed (-A option)
ssh -A ec2-user@public-ip-for-public-instance
Connect to the private instance from the jump box
ssh ec2-user@private-instance-ip