Access EC2 instances without a bastion host

A bastion (jump box) exists to solve one problem: your instances shouldn't be reachable from the internet, but people still need to get in. AWS now solves that problem inside the platform. Session Manager and EC2 Instance Connect Endpoint let you reach private instances from anywhere with no public IP, no inbound port and no extra server to maintain.

1. What a bastion actually costs you

An always-on instance to pay for, patch and back up.
A public IP and an open port (22 or 3389) that gets scanned all day.
Key distribution — every user needs a key to the bastion and a key to each target.
An IP allowlist that breaks every time someone works from a new network.
Weak audit — the bastion's auth log tells you who logged into the bastion, not what they did on the target.

AWS's own description of the risk: leaving inbound SSH and remote PowerShell ports open "greatly increases the risk of entities running unauthorized or malicious commands".

2. Pattern A — Session Manager (agent-based)

The SSM Agent on each instance connects outbound to the Systems Manager service. You connect to the service, IAM decides whether you're allowed, and a two-way channel opens.

Ports: none inbound. Remove the public IP and the 22/3389 rules.
Access control: IAM policies, per instance or by tag; temporary access for on-call.
Audit: CloudTrail for every session start; optional transcripts to S3 or CloudWatch Logs for shell sessions.
Windows and Linux: PowerShell or bash in the browser/CLI; RDP via port forwarding.
Cost: "No additional charges for usage on Amazon EC2 instances."
Requirements: agent, instance profile with AmazonSSMManagedInstanceCore, outbound 443 to the ssm/ssmmessages/ec2messages endpoints or VPC endpoints.

3. Pattern B — EC2 Instance Connect Endpoint (agentless)

An EICE is an identity-aware TCP proxy that lives in one subnet of your VPC. IAM authorises the tunnel; the instance just needs to accept 22 or 3389 from the endpoint's security group.

Ports: 22/3389 open only to the endpoint, not the internet.
No agent, so it works on any image.
Audit: every tunnel attempt, successful or not, is in CloudTrail.
Cost: no additional charge (cross-AZ data transfer applies).
Limits: one endpoint per VPC, 20 concurrent connections, 1-hour tunnels, management traffic only.

4. Side by side

	Bastion host	Session Manager	Instance Connect Endpoint
Public IP on anything	Yes (the bastion)	No	No
Inbound port from internet	Yes	No	No
Server to patch	Yes	No	No
Per-user access control	SSH keys / OS accounts	IAM	IAM
Works on the target without an agent	Yes	No	Yes
RDP to Windows	Via double-hop	Port forwarding	Tunnel to 3389
Session transcript	No (unless you add tooling)	Optional	No
Extra AWS cost	Instance + IP	None	None

5. Migrating off a bastion

Attach an instance profile with AmazonSSMManagedInstanceCore (or enable Default Host Management Configuration) and confirm instances appear in Fleet Manager.
Add VPC endpoints for ssm, ssmmessages, ec2messages if the private subnets have no NAT.
Write IAM policies for ssm:StartSession scoped by instance or tag; hand them out via IAM Identity Center permission sets.
Test a shell session and an RDP port-forward from a laptop without the bastion.
Remove the 22/3389 security-group rules on targets, then stop the bastion. Keep an EICE for any instance that can't run the agent.

Common questions

Is a bastion ever still the right answer?

Rarely — for a third-party appliance that can't run an agent and sits somewhere an EICE can't reach, or when a compliance framework literally names a jump host. Even then, put it behind an EICE or Session Manager rather than a public IP.

Does removing the bastion change how I audit access?

It improves it. CloudTrail records every StartSession or OpenTunnel with the IAM identity; Session Manager can additionally keep a full transcript of shell sessions.

What about instances with no internet access at all?

Session Manager works over VPC interface endpoints (ssm, ssmmessages, ec2messages) with no internet gateway or NAT. An EICE never needs the VPC to have internet access either.