Building a Hardened Bastion Server
In Chapter 10, Configuring Infrastructure Security, you were introduced to the concept of a bastion server. This server is installed in one of the public subnets and acts as a jump box to access the other systems on your AWS network, especially in cases where you need to get in from an external IP address.
Figure 11.10: A bastion server in a public subnet
Figure 11.10 depicts a user outside the network where the AWS VPC resides entering the VPC from the internet gateway with access to the public subnet. Suppose the user’s external IP address has been granted access to the bastion server in the bastion’s security group. In that case, that user can authorize themselves and gain access to the bastion. Once on the bastion server, the user is on the network and can either directly go to the EC2 instance or create an SSH tunnel to one of the resources in the private subnet, such as the EC2 instance or the RDS...
