Bastion host

securitybastion-host

A hardened jump host that brokers administrative sessions into a network.

Category: Security
Properties: 6
Components: 18
Rules: 0

Properties · 6 defined by this kind

A node of this kind resolves each property from its own props, then the component's defaults, then the default below.

property	type	values	required	default
justInTimeAccess	boolean	—	no	false
managed	boolean	—	no	false
mfaRequired	boolean	—	no	—
protocols	enum	ssh \| rdp \| both	no	—
publicIp	boolean	—	no	—
sessionRecording	boolean	—	no	—

Rules for this kind · 0

No rule selects this kind or its category. Governance calls that a recorded gap.

Components · 18

vendor-neutral

Generic bastion hostbastion-hostgenericthe kind itself

alibabacloud

Bastionhostalibaba-bastionhost3 defaults

aws

EC2 Instance Connect Endpointaws-ec2-instance-connect-endpoint3 defaults AWS Systems Manager Session Manageraws-ssm-session-manager4 defaults AWS Verified Accessaws-verified-access2 defaults

azure

Azure Bastionazure-bastion5 defaults Microsoft Entra Private Accessazure-entra-private-access1 defaults

cloudflare

Cloudflare Accesscloudflare-access4 defaults Cloudflare One RDPcloudflare-rdp4 defaults

default

HashiCorp Boundaryboundary4 defaults ContainerSSHcontainerssh5 defaults Paralusparalus4 defaults Pomeriumpomerium2 defaults OpenSSH jump hostssh-jump-host5 defaults Teleportteleport5 defaults

gcp

Chrome Enterprise Premiumgoogle-chrome-enterprise-premium1 defaults Identity-Aware Proxygoogle-identity-aware-proxy2 defaults

oci

Bastionoci-bastion3 defaults

Source

1# yaml-language-server: $schema=../schema/kind.schema.json
2# Holds the session and protocol properties access rules read, which app-server has none of. sessionRecording, mfaRequired and publicIp have no default so an unaudited or exposed jump host is catchable.
3schemaVersion: "1"
4type: "kind"
5id: "bastion-host"
6category: "security"
7properties:
8  protocols:
9    type: "enum"
10    values: ["ssh", "rdp", "both"]
11  sessionRecording:
12    type: "boolean"
13  mfaRequired:
14    type: "boolean"
15  publicIp:
16    type: "boolean"
17  justInTimeAccess:
18    type: "boolean"
19    default: false
20  managed:
21    type: "boolean"
22    default: false

The same page as markdown, for an agent: /catalogue/kinds/bastion-host.md