Preferred way to connect to the 10001 port?

Ray Client requires connecting to remote cluster through the 10001 port. However by default when launching a cluster using the Ray Autoscaler, port 10001 is not open. I need to either manually open the port on AWS UI or use ssh tunneling to forward the 10001 port. What’s the preferred way?

I think the latter is the safer approach? ray dashboard also uses the ssh port forwarding under the hood.