Jumping into private networks
Substrate manages VPCs for each of your environments, as documented in networking, and each of these is constructed with three public and three private subnets. The private subnets, being private, aren't directly accessible from the Internet. And though the public subnets are, it's recommended that the traffic they do allow directly from the public Internet be handled first by ALB, NLB, API Gateway, or the like.
We recommend that you only allow SSH traffic from the public Internet into your Substrate account. Conveniently, this is exactly how the Instance Factory is meant to be used. So in order to jump into your private networks via SSH, use an EC2 instance from the Instance Factory as a jump box.
Substrate takes care of peering VPCs such that your Substrate account will be able to reach all your other networks. It's up to you, however, to configure security groups to allow access where you want to.
To allow SSH from the Instance Factory, create security group rules that allow TCP traffic on port 22 from 192.168.0.0/16. (Your Substrate account is guaranteed to use that CIDR prefix and all your service accounts are guaranteed not to.)
Once you're there, you'll be able to SSH anywhere else in any of your networks that allow SSH from the Instance Factory.