Cloud Bastion Host

Definition

A cloud bastion host (or jump host/jump server) is a hardened, purpose-built server exposed to the internet or a management network that acts as the single controlled entry point for administrators to reach private, otherwise-unreachable resources inside a cloud VPC, such as internal databases or application servers.

Overview

In a well-designed VPC, most compute resources — databases, internal application servers, backend services — live in private subnets with no direct route to or from the public internet, which is good security practice but creates a practical problem: how does an administrator SSH into or otherwise manage those private resources? The bastion host pattern solves this by placing a single, minimal, tightly-secured server in a public subnet, reachable from the internet (usually restricted to specific IP ranges or via a VPN), which administrators connect to first and then 'jump' from into the private network to reach their actual target. Because the bastion is the sole path into the private network, it becomes the natural place to concentrate security controls: strict firewall rules limiting access to known IPs, mandatory multi-factor authentication, short-lived SSH certificates instead of long-lived keys, comprehensive audit logging of every session and command, and a minimal software footprint to reduce attack surface. This turns a potentially sprawling set of exposed internal servers into a single, heavily monitored chokepoint that's much easier to secure, patch, and audit. While the bastion host pattern remains widely used, it has increasingly been supplemented or replaced by newer approaches: cloud-native session-manager services (like AWS Systems Manager Session Manager) that provide shell access to private instances without any inbound port being open at all, relying instead on an outbound agent connection and IAM-based authorization; and zero-trust network access (ZTNA) tools that broker access per-request based on identity and device posture rather than network location. These alternatives reduce the operational burden of running, patching, and monitoring a dedicated bastion server, and eliminate the bastion itself as a potential single point of compromise, which is why many cloud-native shops now treat 'session manager over bastion' as the more modern default, while still using traditional bastions where legacy tooling or hybrid environments require them.

Key Concepts

• Single, hardened entry point into a private VPC network for administrative access
• Runs in a public subnet, other resources stay isolated in private subnets
• Concentrates security controls: MFA, IP allowlisting, short-lived credentials, session auditing
• Minimal software footprint to reduce attack surface on the exposed host
• Increasingly supplemented by agent-based session-manager services requiring no open inbound ports
• Often paired with jump-host SSH proxying (ProxyJump/ProxyCommand) for a seamless admin workflow
• Central point for logging and reviewing all administrative access to private infrastructure
• Common compliance requirement in regulated environments needing auditable privileged access

Use Cases

Frequently Asked Questions

Related in Cloud