EC2 Instance Connect Endpoint

aws Bastion hostaws-ec2-instance-connect-endpoint

An in-VPC tunnel for SSH and RDP to instances that have no public IP address.

Provider: aws
Kind: Bastion host
Category: Security
Official docs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html
Also known as: EIC Endpoint

Properties · 3 set by this component

property	type	values	required	kind default	this component
clientIpPreservation · component property	boolean	—	no	false	inherited
iamAuthorized · component property	boolean	—	no	true	inherited
internetGatewayRequired · component property	boolean	—	no	false	inherited
ipAddressType · component property	enum	ipv4 \| dualstack \| ipv6	no	—	inherited
justInTimeAccess	boolean	—	no	false	inherited
managed	boolean	—	no	false	▸ true
mfaRequired	boolean	—	no	—	inherited
protocols	enum	ssh \| rdp \| both	no	—	▸ both
publicIp	boolean	—	no	—	▸ false
sessionRecording	boolean	—	no	—	inherited

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "ec2-instance-connect-endpoint", component: "aws-ec2-instance-connect-endpoint" }

Other Bastion host products · 17

Bastionhostalibaba-bastionhostalibabacloudbastion-host AWS Systems Manager Session Manageraws-ssm-session-managerawsbastion-host AWS Verified Accessaws-verified-accessawsbastion-host Azure Bastionazure-bastionazurebastion-host Microsoft Entra Private Accessazure-entra-private-accessazurebastion-host Cloudflare Accesscloudflare-accesscloudflarebastion-host Cloudflare One RDPcloudflare-rdpcloudflarebastion-host Generic bastion hostbastion-hostbastion-host HashiCorp Boundaryboundarybastion-host ContainerSSHcontainersshbastion-host Paralusparalusbastion-host Pomeriumpomeriumbastion-host OpenSSH jump hostssh-jump-hostbastion-host Teleportteleportbastion-host Chrome Enterprise Premiumgoogle-chrome-enterprise-premiumgcpbastion-host Identity-Aware Proxygoogle-identity-aware-proxygcpbastion-host Bastionoci-bastionocibastion-host

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# EC2 Instance Connect Endpoint: a jump point inside a VPC subnet that tunnels SSH and RDP to
3# instances that have no public IPv4 address ("Connect to an Amazon EC2 instance using EC2 Instance
4# Connect Endpoint"). Every connection needs an IAM permission, and client IP preservation is off by
5# default, so the endpoint's network interface is the client IP ("Create an EC2 Instance Connect Endpoint").
6schemaVersion: "1"
7type: "component"
8id: "aws-ec2-instance-connect-endpoint"
9kind: "bastion-host"
10provider: "aws"
11docs: "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html"
12aliases: ["EIC Endpoint"]
13defaults:
14  managed: true
15  protocols: "both"
16  publicIp: false
17properties:
18  clientIpPreservation:
19    type: "boolean"
20    default: false
21  ipAddressType:
22    type: "enum"
23    values: ["ipv4", "dualstack", "ipv6"]
24  internetGatewayRequired:
25    type: "boolean"
26    default: false
27  iamAuthorized:
28    type: "boolean"
29    default: true

The same page as markdown, for an agent: /catalogue/components/aws-ec2-instance-connect-endpoint.md