SSH into a private subnet via a bastion host

ssh.config

Host buildserver  # bastion
        HostName 50.123.123.123
        User ec2-user
        ForwardAgent yes
        IdentityFile /Users/dliggat/.ssh/key.pem

Host buildagent  # tunnel ssh through a bastion
        HostName 10.0.0.100
        User ec2-user
        IdentityFile /Users/dliggat/.ssh/key.pem
        ProxyCommand ssh buildserver -W %h:%p
        StrictHostKeyChecking no
        LocalForward 127.0.0.1:8080 10.0.0.100:8080

Host buildagentweb  # forward port 8080 to access web
        HostName 50.123.123.123
        User ec2-user
        IdentityFile /Users/dliggat/.ssh/key.pem
        StrictHostKeyChecking no
        LocalForward 127.0.0.1:8080 10.0.0.100:8080