Okay.
Hello bloggers and welcome to this lecture.
This is just a theoretical lecture to explain what bastion hosts are.
So what is a best in host.
So this is the Wikipedia definition of a bastion host.
It says that it's a special purpose computer on the network specifically designed and configured to
withstand attacks.
And the computer generally hosts a single application for example a proxy server and all other services
are removed or limited to reduce the threat to this computer.
It is hardened in this manner primarily due to its location and purpose which is either on the outside
of a firewall or inside a demilitarised zone.
And what do they mean by demilitarised zone.
Well basically public subnet and it usually involves access from untrusted networks or computers.
So let's have a look at a bastion host in action.
So in here we've got our public subnet which is here and we've got our private subnet in here.
And let's say that we have a net instance our net instance is behind a security group.
And let's also say we have a NAT gateway and you could have one or the other but the differences obviously
net instance is an individual easy to instance which is behind a security group.
And then the NAT gateway doesn't need to be behind a security group and this is much more redundant
it's not a single instance.
So when our instances in our private subnets need to access the Internet they do so via either a net
instance or a Nat gateways.
That's when they're downloading you know patches or installing software etc..
But if we need to go in and administer this environment what would typically happen and got SSA or ADP
so SSA for Linux or ADP going to Windows.
And essentially what it's doing is it's going through the Internet gateway it's going through our route
tables is going through our network ACLU that's going through our security groups and then it's going
on to our bastion server and then our bastion server basically just forwards it forwards the connection
through SSA or through ADP to our instances.
And then what we in this scenario all we need to do is harden our bastion hosts we need to harden as
strongly as possible because that's what's going to try and be hacked and then we don't have to worry
about hardening our instances in our private subnet.
So long as our bastion hosts is hardened that makes it a lot easier we're basically reducing the surface
area in which we need to harden.
So that's all the Bastion is it's a way of SS hating or paying in to your private instances in your
private subnets.
And you essentially just focus on hardening this bastion hosts and you can get bastion hosts are semis
from the AWB as a my community marketplace as well.
So in terms of Bastion host just remember the following a NAT gateway or net instance is used to provide
Internet traffic to easy to instances in private subnets.
So it's not being used to SSA or IDP in a bastion is used to securely administer easy to instances.
So using SSA H or IDP bastions are also called Jump boxes in Australia.
So if you an Australian watching this and you're wondering this sounds exactly like a jump box that's
exactly what it is that the same thing and then you cannot use a NAT gateway as a bastion host.
So if you are going to be paying ISIS reaching into your instances in private subnets you need to go
in and configure a bastion HOST You can't do it through a NAT gateway.
So that is it for this lecture everyone.
In the next lecture we're going to look at direct connect.
Then we're going to go on and look at VPC endpoints and then we have finished the end of the VPC section
of the course.
So if you got the time please join me in the next lecture.
Thank you.