So now let's talk about bastion hosts
and the idea is that our users
want to access an EC2 instance that is
in a private subnet, but we as users,
we are on our computer on the public internet.
So obviously because our EC2 instance
is in a private subnet
we don't have direct internet access to it.
So the trick, or one trick at least,
is to use a bastion host.
The bastion host is an EC2 instance,
that's named bastion host, okay?
And that EC2 instance is special
because it is in a public subnet.
It has its own security group called
the bastion host security group,
then we also have a security group, of course,
for our EC2 instance in the private subnet.
Now, the idea is that the EC2 instance
in the public subnet, our bastion host,
does have access to the EC2 instance in our private subnet,
well, because everything is in our VPC.
So now to access our EC2 instance in the private subnet,
what we do is that we first connect
through SSH to the bastion host
and then connect from the bastion host,
again with SSH, to the EC2 instance in the private subnet.
And it could be one
but it could be as well, many EC2 instances.
So to summarize a bastion host is a way for us
to SSH into our private EC2 instances.
And we must put the bastion host in the public subnet.
So in terms of security group rules,
this is something that can come up with the exam,
we need to understand what we can define.
So for a bastion host perspective,
the security group must allow access
from the internet, okay?
But instead of allowing everywhere
from the internet access,
because that could be a security risk,
we can only restrict, for example,
access from the public CIDR of your corporation
or your internet access and so on.
So that we have to restrict the EC2 security group
of the bastion host as much as possible to guarantee
that only a few select IPs can access it,
because if somehow a random attacker has access
to our EC2 instance as the bastion host,
it could be a security risk for our infrastructure.
Now, in terms of the security group
of the EC2 instances in the private subnets,
well, they must allow the SSH access,
so on the port 22 again, from this time the private IP
of the bastion host
or the security group of the bastion host,
this is equivalent.
And this is because the traffic
these EC2 instances are seeing are originating
from this bastion host.
So that's it for this lecture,
I hope you liked it
and I will see you in the next lecture.