Bastion Host
Term 27 of 68 in the ERPStack technical glossary
What is Bastion Host?
A Bastion Host is a special-purpose computer on a network specifically designed and configured to withstand attacks, serving as a secure gateway for administrators to access internal server networks.
Bastion Host at a glance
- Role
- 1 hardened, audited entry point into a private subnet where databases have 0 public exposure
- Hardening
- Minimal packages, key-based authentication only, session recording, short-lived access grants
- Modern alternative
- Identity-aware session brokers that issue a 1-hour credential and record the session
- Failure mode
- A permanently running bastion with 12 standing accounts becomes the softest target in the estate
- Built with
- A hardened instance in an AWS Virtual Private Cloud defined by Terraform and applied through GitHub Actions, fronting PostgreSQL 18 and Kubernetes workloads, entry through SSO and MFA, sessions logged
- Numbers that matter
- 1 audited entry path; credentials expiring in 1 hour, not 1 year; 0 shared accounts; 2 things to forward, session capture and connection metadata
- Compare with
- A public database endpoint, an identity-aware broker issuing 1-hour credentials, or a Microsoft Azure equivalent
- Commonly paired with
- SSO and MFA at the door, RBAC for authorisation, Kubernetes and PostgreSQL 18 workloads behind it, Terraform on AWS or Microsoft Azure, GitHub Actions applying changes, and SOC 2 or ISO 27001 session evidence
- Standing access
- 0 permanent accounts; 1 request, 1 approval, 1 expiry per session, which is what SOC 2 and ISO 27001 reviewers sample
- What sits behind it
- Private-subnet workloads only: Postgres and Redis instances, Docker and Kubernetes nodes and the queue consumers beside them — 0 of which hold a public address.
- Who asks for one
- Assessors mapping to HIPAA, PCI DSS or FedRAMP Security Controls, and healthcare, finance or government buyers who sample 1 quarter of recorded sessions.
How Bastion Host works in production
The ERPStack approach to Bastion Host
We set up bastion hosts and AWS Systems Manager Session Manager for all private database environments, ensuring your database has no public ports open to the internet.
Frequently asked questions about Bastion Host
Why use a Bastion Host at all?
Because production databases should have no route from the public internet. A Bastion Host gives operators 1 controlled way in: a hardened instance in a public subnet that can reach private resources, where every session is authenticated, authorised and recorded. The alternative — exposing a database port to the internet behind a password — fails the first automated scan it meets.
How should access to the bastion be granted?
Temporarily, and per person. A Bastion Host with permanent accounts and shared keys recreates the problem it was built to solve. Access should be requested, time-boxed and tied to an individual identity protected by Multi-Factor Authentication, with the session logged. Credentials that expire in hours mean a leaked key is worth almost nothing by the time anyone finds it.
Is the bastion pattern obsolete?
The role remains; the implementation has moved on. Instead of a long-lived Bastion Host, many teams now use identity-aware brokers that issue short-lived credentials and record sessions without a permanently running instance to patch. The requirement is unchanged — 1 audited path into a private network — but the surface can now be smaller than a persistent server sitting on the public internet.
What does a well-configured bastion actually log?
Who connected, when, from where, and what they did. A Bastion Host that records only successful logins tells you very little during an incident. Session capture, command history and connection metadata forwarded to storage the operator cannot edit are what make the record useful, and forwarding matters most: logs held only on the host itself are the first thing an intruder removes.