---
title: "Bastion Host — Definition & Engineering Context"
description: "A Bastion Host is a special-purpose computer on a network specifically designed and configured to withstand attacks, serving as a secure gateway for administrators to access internal server networks."
canonical: https://erpstack.io/glossary/bastion-host
markdown_url: https://erpstack.io/glossary/bastion-host.md
publisher: ERPStack
---

# Bastion Host

> **Definition:** A Bastion Host is a special-purpose computer on a network specifically designed and configured to withstand attacks, serving as a secure gateway for administrators to access internal server networks.

## In depth

To protect database servers, engineers place them in private subnets with no public IP addresses. To access these databases for maintenance, administrators connect to a secure, audited bastion server (or jump box) placed in a public subnet. Access is limited to verified IP addresses and SSH keys.

## How ERPStack applies this

We set up bastion hosts and AWS Systems Manager Session Manager for all private database environments, ensuring your database has no public ports open to the internet.

## Related reading

- [Virtual Private Cloud (VPC)](https://erpstack.io/glossary/vpc)
- [Zero-Trust Security](https://erpstack.io/glossary/zero-trust)