Architecture Patterns for HA Bastion Hosts

Highly available bastion hosts require distributed architecture across multiple availability zones. Key patterns include:

• Multi-AZ Auto Scaling Groups: Distribute instances across 3 AZs with health checks
• Network Load Balancer (NLB): Terminate SSH traffic at the NLB layer (TCP:22)
• Immutable Infrastructure: Use pre-baked AMIs with hardened configurations
• Session Recording: Integrate with AWS Session Manager for audit trails

Pro Tip: Place bastions in public subnets with strict security group rules allowing only from the NLB.

Automated Deployment Strategies

Infrastructure-as-Code (IaC) ensures consistent deployments:

# AWS CloudFormation Snippet
Resources:
  BastionAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      MinSize: 2
      MaxSize: 4
      AvailabilityZones: !GetAZs 
      LaunchConfigurationName: !Ref BastionLaunchConfig
      TargetGroupARNs:
        - !Ref BastionTargetGroup

Deployment workflow:

1. Build hardened AMI using Packer
2. Deploy ASG with CloudFormation/Terraform
3. Configure NLB with TLS termination
4. Integrate with AWS Systems Manager

Security Hardening Techniques

Critical security controls for bastion hosts:

• SSH Key Rotation: Automate using AWS Secrets Manager
• Port Knocking: Implement dynamic firewall rules
• Two-Factor Authentication: Integrate with Duo or Authy
• JIT Access: Temporary credentials via AWS IAM

Security group configuration example:

# Allow SSH only from NLB security group
Ingress:
  - IpProtocol: tcp
    FromPort: 22
    ToPort: 22
    SourceSecurityGroupId: sg-nlb-group

Scaling and Failover Strategies

Maintain availability during traffic spikes:

• Auto Scaling Metrics: Scale based on SSH session count
• Health Checks: Route 53 health checks on TCP:22
• Multi-Region Deployment: For global teams using AWS Global Accelerator

Cost Analysis and Optimization

Cost breakdown for HA bastion infrastructure:

Optimization techniques:

• Schedule scaling to office hours
• Use Spot Instances for development environments
• Implement session timeout policies