How would I run Salt commands from a local salt master to salt minions on EC2 via AWS SSM?

Hi, I've been trying to look into this, and the only thing I have come up with is using the Saltstack document in SSM.

However, this is a bit cumbersome, since I can't actually just go the salt master and issue a cli command; I'll have to wrap it in the AWS SSM command for it to work.

I'm looking for a workaround for my situation. My infrastructure is very simple; a couple of EC2 instances in a private subnet.

I read online that AWS SSM was likely the most secure option in trying to access resources in private subnets, but it looks like I'll have to go DIY with gateways myself. How do you think I should approach this? I would like to use salt for day 1 and day 2 operations.

Thanks!