Pomerium

Bastion hostpomerium

Identity-aware proxy that checks identity, device state and request context per request and tunnels SSH, RDP and database traffic over HTTP.

Provider: default
Kind: Bastion host
Category: Security
Official docs: https://www.pomerium.com/docs

Properties · 2 set by this component

property	type	values	required	kind default	this component
edition · component property	enum	core \| zero \| enterprise	no	core	inherited
justInTimeAccess	boolean	—	no	false	inherited
managed	boolean	—	no	false	▸ false
mfaRequired	boolean	—	no	—	inherited
nativeSsh · component property	boolean	—	no	false	inherited
protocols	enum	ssh \| rdp \| both	no	—	▸ both
publicIp	boolean	—	no	—	inherited
sessionRecording	boolean	—	no	—	inherited
tcpOverHttp · component property	boolean	—	no	true	inherited

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "pomerium", component: "pomerium" }

Other Bastion host products · 17

Bastionhostalibaba-bastionhostalibabacloudbastion-host EC2 Instance Connect Endpointaws-ec2-instance-connect-endpointawsbastion-host AWS Systems Manager Session Manageraws-ssm-session-managerawsbastion-host AWS Verified Accessaws-verified-accessawsbastion-host Azure Bastionazure-bastionazurebastion-host Microsoft Entra Private Accessazure-entra-private-accessazurebastion-host Cloudflare Accesscloudflare-accesscloudflarebastion-host Cloudflare One RDPcloudflare-rdpcloudflarebastion-host Generic bastion hostbastion-hostbastion-host HashiCorp Boundaryboundarybastion-host ContainerSSHcontainersshbastion-host Paralusparalusbastion-host OpenSSH jump hostssh-jump-hostbastion-host Teleportteleportbastion-host Chrome Enterprise Premiumgoogle-chrome-enterprise-premiumgcpbastion-host Identity-Aware Proxygoogle-identity-aware-proxygcpbastion-host Bastionoci-bastionocibastion-host

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Pomerium: open source identity-aware proxy built around BeyondCorp and zero trust that verifies
3# user identity, device state and request context before granting access ("What is Pomerium?").
4# The same page gives three editions: Pomerium Core, self-managed; Pomerium Zero, a managed
5# control plane with a self-run data plane; and Pomerium Enterprise, a self-hosted control plane.
6# "TCP over HTTP Support" documents non-HTTP targets reached by tunnelling TCP over an HTTP
7# CONNECT stream (SSH, RDP, Postgres, MySQL, Redis), with native SSH access as a separate,
8# non-tunnelled path. Session recording and audit logs are listed capabilities, not stated
9# defaults, so neither is defaulted here.
10schemaVersion: "1"
11type: "component"
12id: "pomerium"
13kind: "bastion-host"
14provider: "default"
15docs: "https://www.pomerium.com/docs"
16defaults:
17  managed: false
18  protocols: "both"
19properties:
20  edition:
21    type: "enum"
22    values: ["core", "zero", "enterprise"]
23    default: "core"
24  tcpOverHttp:
25    type: "boolean"
26    default: true
27  nativeSsh:
28    type: "boolean"
29    default: false

The same page as markdown, for an agent: /catalogue/components/pomerium.md