Upgrade your bastion with a drawbridge
It’s a known best practice to use a bastion host to access your private resources, whether it’s in the cloud or your data centers.
The goal is that only the bastion host is reachable, either directly from the internet or particular IPs. It’s the only entry point to your infrastructure, so it’s easier to secure this single server.
AWS published an excellent Quick Start Reference Deployment Guide: multiple bastion hosts are deployed across Availability Zones with static IPs.
However, do you really need multiple bastions to run at all time?
Maybe you don’t even SSH to your server that often? Because “if you have to SSH into your servers, then your automation has failed”.
So why not remove the entrance to our bastion when we are not using it:
All we have to do is set up the server to terminate when no one is connected and add some convenient way to launch a new one when we need it.
Raise the bridge
With AWS it’s quite easy, here’s a sample cloud formation template.
First, we create an auto scaling group with a single instance and a launch configuration:
Through the instance’s
UserData, you can run commands on your instance at launch.
We are going to configure a crontab that sends the number of connected users every minute to the cloudwatch metric
Also, we have created an elastic IP that we will associate every time at boot, so we always have the same public IP.
Now we just need a cloudwatch alarm with an auto scaling policy:
When our cloudwatch metric
<= 0 for 15 consecutive minutes, we will initiate the
ScaleDown policy which sets the
DesiredCapacity of our auto scaling group to
0. Which will terminate the instance.
Lower the bridge
To start a new bastion, the quickest way is aws cli :
aws autoscaling set-desired-capacity --auto-scaling-group-name 'bastion-ASG-XXXXXXX' --desired-capacity 1
But you can find a lot of other ways, I, for instance, like to start it via Slack. I have a dedicated channel for the bastion, so everyone is notified when someone starts it.
Here’s my script for hubot:
And you, how do you handle your bastion?