What is a bastion host? The controlled way into a private network
A bastion host (or jump box) is a specially hardened server that acts as a single, controlled entry point for administrators to access resources in a private network, so those resources never need to be exposed directly to the internet. The name comes from the fortified outer walls of a castle — a bastion — and the idea is the same: put one heavily defended point between the outside world and everything you actually want to protect. It is the practical answer to a problem every private network eventually faces: someone still needs to log in and administer the servers inside it. This article covers the problem a bastion host solves, how it works, why it matters for security, the managed alternatives that are increasingly replacing it, and where it appears in cert study.
The problem it solves
A server placed in a private subnet — see the what-is-a-subnet explainer — has no route to or from the internet, which is exactly why sensitive systems belong there. But "no route from the internet" also means an administrator sitting at home cannot simply connect to it directly to apply a patch or investigate an issue. Some controlled way in is unavoidable.
The naïve fix — giving every private server a public address so it can be reached for administration — defeats the entire purpose of putting it in a private subnet. A bastion host offers a narrower, deliberate alternative: expose exactly one server to the outside world, harden it heavily, and route all administrative access through that single point.
How it works
An administrator connects first to the bastion host, which does sit in a public subnet with a public address, reachable — usually only from a restricted set of trusted source addresses. From there, they "hop" onward to the private resource they actually need to reach, over the internal network, using the bastion as a relay rather than a destination in itself.
The bastion is deliberately kept minimal: it runs little beyond what is needed to accept and forward administrative connections, is patched aggressively, and every session through it is logged. It is the one exposed door, built to be watched constantly and to have nothing else worth attacking behind it.
Why it matters for security
A bastion host shrinks the attack surface dramatically: instead of many private servers each needing some path in for administration, there is exactly one hardened, monitored entry point to defend well. It also centralises access control and auditing — who connected, when, and to what — which is a direct application of least-privilege thinking (grant only the access needed, nothing more) and the broader zero-trust idea that no connection, even from inside the network perimeter, is trusted by default without verification.
That centralisation is valuable independent of the technology: even organisations with strong identity and access management practices still benefit from having one place where "someone administered a private server" is visible and reviewable, rather than that trail being scattered across many individually reachable machines.
Modern alternatives
Cloud providers increasingly offer managed access services that reduce the need for a traditional, always-on bastion host. AWS Systems Manager Session Manager, for instance, lets an authorised administrator open a session directly to a private instance without any inbound port ever being opened and without a separate bastion server to patch and maintain — access is governed by identity and access management policy instead. Azure Bastion provides a comparable managed service, giving secure connectivity to private virtual machines through the Azure portal without exposing them via a public address.
These services do not eliminate the underlying idea — a single, audited, tightly controlled path into a private network — they just replace the standalone server you would otherwise have to build and maintain yourself with a managed equivalent. A traditional bastion host remains a perfectly valid, well-understood pattern, and is still what many existing architectures run.
Best practices
Whichever form it takes, a few habits keep a bastion doing its job well.
- Least privilege — restrict who can reach the bastion, and what each administrator can do once inside, to only what their role requires.
- Logging — record every session through the bastion, since it is the one place all administrative access to the private network passes through.
- Patching — keep the bastion itself current, since it is the one server deliberately exposed and therefore the one most worth an attacker’s attention.
Where it appears in cert study
The bastion-host pattern is a recurring scenario in associate-level security and networking questions, particularly on the AWS Solutions Architect Associate exam, where it is tested alongside public-versus-private subnet design. The AWS Security Specialty exam goes further, expecting familiarity with both the traditional bastion pattern and managed alternatives such as Session Manager as a more modern, lower-maintenance option. The Azure Administrator Associate exam covers Azure Bastion within its networking and security domains.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.