The security group egress {} is missing, so the bastion instance can't actually reach any private IP address.

Did you maybe mean this to be an egress?
https://github.com/cloudposse/terraform-aws-ec2-bastion-server/blob/master/main.tf#L55

Since it's possible to create custom session documents it should be useful to have support for that.