A bastion host is a hardened jump server that sits at the edge of a private network and provides a controlled path to internal systems. Instead of exposing databases, admin consoles, or SSH endpoints directly to the internet, defenders allow access only through the bastion, where authentication, logging, and network restrictions are stricter.
Bastion hosts matter because they concentrate trust. If an attacker steals credentials or reaches the bastion through a weak application boundary, they may gain a stepping stone into otherwise isolated assets. In cloud environments, bastions are often used with VPNs, SSH keys, MFA, IP allowlists, and short-lived credentials to limit misuse. For defenders, the key risks are poor credential hygiene, overly broad IAM permissions, and weak monitoring of who connects and where they pivot next.