A bastion host is the best option described for accessing cloud resources without direct internet access. It acts as a secure gateway to access internal networks from external sources and is often used in conjunction with other security measures such as SSH for secure connections.
Reference: The use of bastion hosts as a secure access point to cloud resources is a security best practice covered in the CompTIA Cloud+ certification's domain on cloud security.