Manage user access - Bastion Host

Question

Hi,
I am just looking to start using Bastion Host, in our infrastructure.
So, I am trying to find a way to limit user access when using SSH by Bastion Host.
For example, Can I use the Federate access (SSO with AAD) to let users access the Bastion Host, then assign them permissions/roles at the AWS?

Anyone can advise?

Answer

Use Systems Manager Sessions Manager. Then use AAD and AWS IAM Identity Centre Permission sets (thats how I assume you are using SSO) to grant the right set of users the right set of permissions to use Sessions Manager. This will have a markedly better security posture.

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

Answer

I advise to use Systems Manager's Sessions Manager instead of a bastion host, if possible. Read more about it here: [Replacing a Bastion Host with Amazon EC2 Systems Manager](https://aws.amazon.com/blogs/mt/replacing-a-bastion-host-with-amazon-ec2-systems-manager/).

Manage user access - Bastion Host

Contenido relevante