Google IAP vs AWS Session Manager vs Azure Bastion
All three clouds now ship a first-party way to reach a VM that has no public IP and no open inbound port, with the cloud's own identity system deciding who gets in. They differ in how the tunnel is built, what the client needs, and what it costs. This page compares them; the per-cloud clusters go deeper.
1. The one-line versions
- Google Cloud IAP TCP forwarding — an identity-aware proxy in front of a fixed
Google IP range; IAM role
roles/iap.tunnelResourceAccessorgates the tunnel, a firewall rule from35.235.240.0/20lets it reach the port. No agent on the VM. - AWS Session Manager — the SSM Agent on the instance calls out to AWS; IAM
ssm:StartSessiongates the session. Zero inbound ports. Alternative: EC2 Instance Connect Endpoint, an agentless identity-aware TCP proxy inside the VPC. - Azure Bastion — a managed jump host deployed into your VNet; Azure RBAC (Reader on VM/NIC/Bastion) gates it; connects to the VM's private IP on 3389/22.
2. Side by side
| Google Cloud IAP | AWS Session Manager | AWS Instance Connect Endpoint | Azure Bastion | |
|---|---|---|---|---|
| Identity check | Google IAM (+ Context-Aware Access) | AWS IAM (+ Identity Center/MFA) | AWS IAM | Azure RBAC + Entra ID (+ Conditional Access) |
| Agent on VM | No | Yes (SSM Agent) | No | No |
| Inbound port on VM | Yes, from IAP range only | None | Yes, from endpoint SG only | Yes, from AzureBastionSubnet only |
| Public IP on VM | No | No | No | No |
| Infrastructure you deploy | Firewall rule | Instance profile (+ VPC endpoints) | One endpoint per VPC | Bastion host + /26 subnet + public IP |
| Protocols | Any TCP port | Any port (forwarding), shell | 22 and 3389 | RDP, SSH (tunnel for either) |
| Windows RDP | Yes (tunnel 3389) | Yes (port forward 3389) | Yes (tunnel 3389) | Yes (portal or native client) |
| Browser client | Yes (SSH in console) | Yes (shell) | Yes (SSH) | Yes (all SKUs) |
| Local client tooling | gcloud | AWS CLI + Session Manager plugin | AWS CLI v2 | az CLI + bastion extension (Standard+) |
| Session transcript | No (audit log of tunnel) | Optional for shell sessions | No | Session recording (Premium, portal) |
| Audit | Cloud Audit Logs | CloudTrail | CloudTrail | Activity Log / diagnostics |
| Cost | No per-use IAP fee | None on EC2 | None (cross-AZ data) | Hourly per SKU from deployment; Developer free |
| Concurrency limits | Per-project quotas | Per-account quotas | 20 per endpoint, 1-hour tunnels | 20 RDP + 40 SSH per instance, 2–50 instances |
3. Where each is strongest
Google IAP is the lightest to set up — one firewall rule, one IAM binding — and it inherits Google Workspace identity and Context-Aware Access. It's the natural fit when the servers and the people are already in Google.
AWS Session Manager is the most locked-down: nothing inbound at all, plus optional full transcripts. Its price is the agent and instance profile, and the CLI plugin on every laptop. Instance Connect Endpoint covers instances that can't run the agent.
Azure Bastion is the most "product-like": portal-based RDP/SSH on every SKU with no client software, session recording on Premium, and first-class Entra ID sign-in — at an hourly cost that runs whether or not anyone connects.
4. Where they're the same
- The cloud, not you, enforces identity and MFA.
- Revoking access is an IAM/RBAC change; nothing lingers on the laptop.
- The VM still checks the OS login (Windows password, SSH key). The cloud gates the tunnel, not the login.
- Traffic stays between your user and the cloud — there's no third party in the path.
5. One client across all three
The rough edge in every column is the client: gcloud, the AWS CLI plus plugin, or
az with extensions, each with its own login dance. TYO Reach's Remote Targets
support all three backends — Google IAP,
AWS SSM/EICE and Azure Bastion
— so a team member clicks the machine in the tray, signs in with the relevant cloud
identity, and RDP/SSH opens. The cloud still enforces everything above; Reach just removes
the per-laptop tooling.
Common questions
Which is cheapest?
IAP and Session Manager have no per-use charge (you pay for VMs and egress as usual). Instance Connect Endpoint is free bar cross-AZ data. Azure Bastion is the only one with a standing hourly charge — unless you're on the free Developer SKU in dev/test.
Which is most secure?
They're all identity-gated with no public IP on the VM. Session Manager goes furthest by needing no inbound port at all; IAP and Bastion still open the port to a specific trusted source (Google's IAP range, the Bastion subnet).
Do I need different tools for each cloud?
Natively, yes — gcloud, the AWS CLI + Session Manager plugin, and az. A multi-cloud
client such as Reach's Remote Targets is the way to give non-technical staff one workflow.
Can any of them reach on-premises servers?
Session Manager can, via hybrid activation of on-prem nodes. IAP and Bastion are scoped to their cloud's networks (Bastion reaches peered VNets).