In short, you can use cloud providers' web interface as an escape hatch. This just works as long as you manage the firewall using your cloud provider's network filter, such as Security Group, rather than, say, iptables.
Some providers like digitalocean use a serial connection for the terminal, so it works even when the network configuration is completely broken somehow (totally not because you set the input policy to drop without making an accept rule first)
Here is exactly what I would do:
1. Sign in to AWS console (with my Yubikey).
2. Click "Lightsail > instances > <my-server>"
3. Click "Networking > Allow Lightsail browser SSH/RDP"
4. Click "Connect using SSH".
5. Do debugging!
In short, you can use cloud providers' web interface as an escape hatch. This just works as long as you manage the firewall using your cloud provider's network filter, such as Security Group, rather than, say, iptables.