A senior engineer told me that bastion hosts have been insecure and outdated for the past decade. With modern zero-trust approaches, is the traditional bastion or jump host actually falling out of favor, and what is the recommended way to provide secure, monitored access to isolated production systems?
For example, imagine a production database that accepts application traffic through a load balancer and allows administrative access to its underlying host only from one specifically controlled machine. That machine is reachable only through a VPN, restricted to approved developer devices, and protected with strong or break-glass authentication.
A developer suggested removing the bastion entirely and installing a zero-trust access agent on both the database host and developer laptops, allowing developers to connect directly. Is that approach generally safer, or can a properly designed bastion still be the better choice?
2 Answers
A bastion is still common in hybrid, on-premises, air-gapped, or multi-cloud environments where a provider-specific session service is unavailable. It can sit behind a VPN or private access layer, use centralized authentication, issue short-lived credentials, restrict commands and destinations, and record sessions.
The important distinction is not 'bastion versus zero trust.' A bastion is a network access pattern, while zero trust describes how access decisions are made. A bastion with static keys and broad trust is weak; a bastion integrated with identity, device checks, just-in-time authorization, segmentation, and auditing can be quite strong.
The practical recommendation is to choose the smallest access path that meets the task. Use session management for host administration when available, a private database access gateway or tightly scoped VPN for database work, and a bastion or jump host where those services are not suitable. Keep production systems private, avoid permanent user keys, separate normal and emergency access, and monitor both successful and failed sessions.
There is no universal rule that bastions must be removed. The senior engineer may be criticizing an old pattern rather than the concept itself: one publicly exposed SSH server with unmanaged keys is outdated, but a controlled access gateway remains a valid architectural component.
The VPN itself can serve a similar gateway role, so changing the name does not change the security model. What matters is whether access is narrowly authorized and temporary rather than simply allowing anyone on the network to reach everything.