Bastion Host
The single hardened jump box that funnels admin access into private networks — a pattern now being replaced by session brokers that need no open ports at all.
What is a bastion host?
A bastion (jump box) is a deliberately minimal, hardened server in a public subnet that exists for one purpose: administrators SSH/RDP to it, then hop onward to instances in private subnets. It converts “every server reachable for management” into “one heavily-watched door” — a single choke point to patch aggressively, log completely, and restrict to office/VPN source IPs.
Doing the classic pattern properly
The bastion’s security group allows 22 only from known admin CIDRs; private-tier SGs allow 22 only from the bastion’s SG. SSH agent forwarding is the traditional companion and a real risk — a compromised bastion can hijack forwarded agents; ProxyJump (ssh -J) is the safer modern default, tunneling through without exposing your agent. Every session gets logged; nothing else runs on the box; and it’s rebuilt from a clean image on a schedule, not patched artisanally for years.
The pattern’s honest obsolescence
Cloud-native session brokers have largely superseded bastions: AWS SSM Session Manager (and EC2 Instance Connect Endpoint, GCP IAP, Azure Bastion) provide shell access to private instances with no inbound ports open anywhere, no public IP, no key distribution — authenticated by IAM, recorded to CloudTrail/S3, and revocable per-identity. The residual bastion use cases are narrow: non-SSM-capable appliances, database GUI tunneling, multi-cloud uniformity. New builds should justify a bastion, not default to one — an open port 22 you don’t need is attack surface you chose.
What people get wrong
- A bastion plus open SSH on private hosts anyway — the funnel only works if it’s the only path.
- Fat bastions: monitoring agents, cron jobs, and tooling accumulate until the choke point is itself a rich target.
- Shared accounts and keys, destroying the per-admin audit trail that justified the pattern.
Primary source: AWS — Session Manager documentation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.