Debugging refused ssh connection to EC2 instance

I have created a new EC2 instance api1-new in the same subnet, same VPC and using the same security groups as an old instance api1-old. api1-new was created from an Ubuntu Linux AMI that already has several users pre-configured, and additionally, I launched it with an Amazon key pair.

1. I cannot connect by ssh -vvv -p Y my_alias nor ssh -vvv -p Y X.X.X.X from my bastion server, which is in a different subnet from the api1 instances. The first and only error message in the ssh output is:

   debug1: connect to address X.X.X.X port Y: Connection refused

2. I can connect to api1-old from the same bastion server using the same port, logged in as the same user as in 1.

3. I can connect to api1-new from my gitlab runner, which is in a third subnet, logged in as the same user as in 1.

4. I can connect from the same bastion server, logged in as the same user, to an instance launched (some time ago, by a colleague) from the same AMI as api1-new into the third subnet.

5. I have placed default ACLs (all traffic allowed) on all three subnets involved, but still cannot connect.

6. When I add a ping security group to api1-new, I can ping to it from the bastion server, logged in as the same user as in 1.

7. The $HOME folder, $HOME/.ssh folder and $HOME/.ssh/authorized-keys are rigorously the same (permissions and content) on api1-new, api1-old and on the server mentioned in 4.

8. I cannot connect from the bastion server to api1-new using the Amazon key pair I created for launching api1-new, whether connecting as ubuntu or as my normal user. The MD5 fingerprint of the private key on the bastion server is identical to what I see in the system log of api1-new.

The api1 instances don't have public IP addresses.

I feel I am missing some part of the puzzle in addition to security groups, ACLs and authorized_keys.

I wonder if there is some way to log refused SSH connections on api1-new to get the reason why the connection was refused.

Thanks to wesleywh for the suggestion to look at /etc/ssh/sshd_config!