SSH to BAstion ec2-user#localhost: Permission denied (publickey,gssapi-keyex,gssapi-with-mic) - ssh

Question

I am trying to connect to my AWS RDS cluster via an EC2 bastion. I first exceute this line to establish an ssm-session to the bastion:
jameseaston#Jamess-MacBook-Pro code % aws ssm start-session \
--target i-09d38c1******* \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["22"], "localPortNumber":["9995"]}'
Starting session with SessionId: qa-prod-0149f4e1c8aaaa10b
Port 9995 opened for sessionId qa-prod-0149f4e1c8aaaa10b.
Waiting for connections...
Connection accepted for session [qa-prod-0149f4e1c8aaaa10b]
This works fine.
I then need to create an ssh connection over this ssm session:
jameseaston#Jamess-MacBook-Pro code % ssh -i ~/.ssh/notifications_bastion_production.pem ec2-user#localhost \
-p 9995 \
-N \
-L 3389:qa-portal-production-notifications-rds.cluster-crb*********.eu-west-2.rds.amazonaws.com:5432 -v
This part is failing with the error message:
ec2-user#localhost: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
The output is below.
Having read quite a few posts its worth noting:
I have checked the sshd_config on the bastion and this is configured the same as our test and staging boxes and these work
There is no password on the ssh key
Any help much appreciated!
OpenSSH_8.6p1, LibreSSL 3.3.6
debug1: Reading configuration data /Users/jameseaston/.ssh/config
debug1: /Users/jameseaston/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to localhost port 9995.
debug1: Connection established.
debug1: identity file /Users/jameseaston/.ssh/notifications_bastion_production.pem type -1
debug1: identity file /Users/jameseaston/.ssh/notifications_bastion_production.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: compat_banner: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to localhost:9995 as 'ec2-user'
debug1: load_hostkeys: fopen /Users/jameseaston/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305#openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305#openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:TJZV4J1RmIzEwIwvDNm3mjll1rrP/f0QxiUD7kb3NeI
debug1: load_hostkeys: fopen /Users/jameseaston/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: checking without port identifier
debug1: load_hostkeys: fopen /Users/jameseaston/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: hostkeys_find_by_key_hostfile: hostkeys file /Users/jameseaston/.ssh/known_hosts2 does not exist
debug1: hostkeys_find_by_key_hostfile: hostkeys file /etc/ssh/ssh_known_hosts does not exist
debug1: hostkeys_find_by_key_hostfile: hostkeys file /etc/ssh/ssh_known_hosts2 does not exist
The authenticity of host '[localhost]:9995 ([127.0.0.1]:9995)' can't be established.
ED25519 key fingerprint is SHA256:TJZV4J1RmIzEwIwvDNm3mjll1rrP/f0QxiUD7kb3NeI.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:9995' (ED25519) to the list of known hosts.
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: /Users/jameseaston/.ssh/notifications_bastion_production.pem explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/jameseaston/.ssh/notifications_bastion_production.pem
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
ec2-user#localhost: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).