An AWS Bastion host is a secure, fully managed service that enables you to connect to your virtual private servers (VPSs) through a browser-based Secure Shell (SSH) or Remote Desktop Protocol (RDP) session. It allows you to access your instances in a private subnet without the need for an Internet gateway, VPN, or a NAT device. With Bastion, you can connect to your instances using the AWS Management Console or the AWS CLI, and it supports both Linux and Windows instances. Additionally, Bastion supports multi-factor authentication (MFA) and offers audit logs for compliance and security purposes.
Architecture of AWS Bastion Host
The architecture of a Bastion host typically includes the following components:
- An EC2 instance running the Bastion host software, which is typically configured to run on a public subnet in your VPC.
- An Elastic IP address that is associated with the Bastion host, which allows you to connect to it from the internet.
- Security groups that control access to the Bastion host, typically allowing only specific IP addresses or ranges to connect.
- A VPC route table that routes traffic to the Bastion host.
- The instances that you want to connect to, which are typically running on private subnets in your VPC.
When you connect to a Bastion host, you are authenticated using your AWS credentials, and then you can use the host to connect to other instances in your VPC. This allows you to securely access instances in your VPC from anywhere, without the need for a VPN or Direct Connect.
AWS Bastion Host Features
Some of the features of Bastion Host include:
- Secure Access: Bastion Host uses Secure Shell (SSH) and Remote Desktop Protocol (RDP) to provide secure access to instances in your VPC.
- Easy to Use: Bastion Host is easy to set up and use. It integrates with your VPC and requires no additional software to be installed on your instances.
- Auditing: Bastion Host provides detailed connection and authentication logs that can be used for auditing and troubleshooting.
- High Availability: Bastion Host is designed for high availability and automatically scales to handle large numbers of connections.
- Multi-Factor Authentication: Bastion Host supports multi-factor authentication (MFA) to provide an additional layer of security.
- Cross-Account and Cross-Region Support: You can use Bastion Host to access instances across different accounts and regions, making it easy to manage a multi-account or multi-region environment.
- Cost-effective: Bastion Host is a cost-effective solution, with low hourly rates and no upfront costs or long-term commitments.
