Bastion Host

Your database server sits in a private subnet. No public IP. No Internet Gateway route. This is exactly right, but now you need to run a migration, check logs, or troubleshoot an issue. You cannot SSH in because the server is unreachable from the internet.

A bastion host (also called a jump box) solves this. It is a single, hardened server in a public subnet that acts as the gateway to your private infrastructure. You SSH into the bastion, then from the bastion, you SSH into private servers. The bastion is the only server exposed to the internet on SSH port 22.

Why not just make each private server temporarily public when you need access? Because every public IP is an attack surface. Every exposed SSH port is a target for brute-force bots. Cloudflare's 2023 SSH threat report found that the average public-facing SSH server receives 13,000 unauthorized login attempts per day. A single bastion with strict security groups, audit logging, and MFA provides a controlled, auditable chokepoint for all administrative access.

The access chain:

Developer laptop -> SSH -> Bastion (public subnet) -> SSH -> Private server

Security hardening checklist:

• Minimal OS installation, remove everything unnecessary
• SSH key authentication only, disable password auth entirely
• MFA on SSH, require a second factor (TOTP, hardware key)
• Security group: allow SSH (port 22) only from known IP ranges (office, VPN)
• All sessions logged, record commands for audit trail
• Auto-shutdown, turn off when not in use
• Regular patching, this is the most exposed server, keep it current

Cost optimization: Do not run a bastion 24/7. Use an on-demand bastion: start it when needed, stop it after. Or better, use AWS Systems Manager Session Manager, which provides shell access to private instances without any bastion at all (no SSH port exposure, no public IP needed, full audit trail).