I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances.

There are tutorials for creating SSH bastions in AWS:

I know several people who do this.

I also see articles about not doing this:

Assuming I am using IAM roles, security groups, etc. correctly, are there good reasons I should strongly consider using a (SSH) bastion? What are they?

2 Answers 2


I have just finished reading the post against bastion hosts. At first the author says that doing that goes against what the majority consideres as best practices. Attempting to make that interesting post short I would identify the following most important points:

  • nothing is wrong per se when using a bastion host it may simply be not as powerful as you could hope
  • the drawbacks are:
    • one more machine to maintain
    • a false security feeling could lead to lower the in depth protection rules - which is definitely bad.

IMHO this last point is the worst use case. People often want to just buy security without worrying of all the security rules, and are told that a bastion is their solution. What it is not. A bastion host is indeed a nice tool to increase security, but it will be helpless if the princip of least privilege is not respected.

Long story short, my opinion for best security practices is:

  1. define what threats you want to considere
  2. define what are the minimum rights that must be enabled to allow you business process
  3. ensure that only that rules are allowed

Then if your security threat analysis shows that you need a strong protection at you internal network entrance (which is the common use case), then a bastion host is probably usefull, provided it is consistenly monitored and maintained with up to date versions of its software. If you cannot meet that condition, then you will only have a false security sentiment. If you find you saying My security relies on the bastion host, and I do not want to be bored with any other security consideration, then the bastion host is probably more harmfull than usefull.


In my current company we use a SSH bastion with a setup that I think is easy to setup, the server only allows SSH connections by using cert, no password login is allow and also there is http://www.fail2ban.org/ setup. This server is behind a firewall and not sure if there is connection limits to the server. I think personally that is a good idea to have a bastion server probably other users will have a different opinion.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .