High memory usage and slowness on EC2 bastion host due to multiple Chrome GUI sessions

You are correct in your understanding that running GUI applications like Chrome on a bastion host is not aligned with AWS best practices. Bastion hosts are intended to serve as secure, minimal jump points for administrative access to private resources within your VPC, not as general-purpose workstations.

From an architectural perspective, bastion hosts should be:

Minimal and Purpose-Built: They should only run the essential services needed for secure access (SSH/RDP) to private resources. Running resource-intensive GUI applications like Chrome introduces unnecessary overhead and security risks.

Secured and Controlled: The more software and services running on a bastion host, the larger the attack surface. A bastion host exposed to external networks should be hardened and limited to its core function of providing controlled access.

Recommendations to Address Your Issue:

1. Separate Workstation Access from Bastion Access: Users should not be using the bastion host as a workstation. Chrome and other GUI applications should run on users' local machines or dedicated virtual desktop instances, not on the bastion host itself.

2. Consider AWS CloudShell as an Alternative: AWS CloudShell provides a browser-based shell environment that can be configured to run inside your VPC (CloudShell VPC). This eliminates the need to manage bastion host infrastructure entirely, as AWS handles all underlying maintenance, patching, and security. CloudShell VPC provides:

• Zero infrastructure maintenance
• IAM-controlled access without SSH key management
• Direct access to private VPC resources
• No public IP exposure
• Automatic session expiration for enhanced security

3. Use AWS Systems Manager Session Manager: This allows secure access to EC2 instances without requiring open inbound ports or managing SSH keys. It provides audit logging and can be used instead of traditional SSH through a bastion host.

4. Implement Proper Access Controls: Use IAM policies to control who can access the bastion host and ensure users understand it should only be used for SSH/CLI access to private resources, not as a general-purpose system.

5. Right-Size or Reconfigure: If you must continue using the current bastion host, consider either upgrading the instance type or, better yet, reconfiguring user workflows to eliminate GUI usage entirely from the bastion host.

The performance issues you're experiencing are a direct result of using the bastion host outside its intended purpose. Addressing the root cause—inappropriate usage patterns—will resolve both the performance problems and improve your security posture.
Sources
Using AWS CloudShell Over Bastion Hosts for Seamless Access to Private Resources | AWS re:Post
Access a bastion host by using Session Manager and Amazon EC2 Instance Connect - AWS Prescriptive Guidance