https://cloudfoundation.org/assets/managed-bastion-hosts.html.3219fdbb.js

1import{_ as r,e as i,o as l,c,k as e,l as o,w as a,F as d,h as t}from"./app.80a6da87.js";const u={},_=e("p",null,"Managed bastion hosts are essential for running a \u201Cpublic\u201D networking model (cloud only connected to internet). Risks are high when application teams with little cloud skill build their own access solutions (e.g. vulnerable SSH implementations, weak ciphers etc.). Public IP ranges are continuously scanned and attacked.",-1),h=e("p",null,"Cloud foundation teams may get away not offering dedicated bastion hosts when running in a private or hybrid networking model (connections always come from on-premise). Still recommended for security and auditing though.",-1),m=e("p",null,"There\u2019s two main implementation strategies for building bastion hosts",-1),p=t("leveraging cloud-native services like "),g={href:"https://learn.microsoft.com/en-us/azure/bastion/bastion-overview",target:"_blank",rel:"noopener noreferrer"},f=t("Azure Bastion"),w=t(" by pre-configuring them to integrate with your landing zone\u2019s network infrastructure (see "),k=t("Virtual Network Service"),b=t(")"),y=t("building a custom bastion host, possibly on top of an already existing "),v=t("Virtual Machine Service"),x=t(" and with PAM software components on top like "),B={href:"https://www.boundaryproject.io/",target:"_blank",rel:"noopener noreferrer"},S=t("boundary"),V=t(" or CyberArk");function C(L,N){const n=i("ExternalLinkIcon"),s=i("RouterLink");return l(),c(d,null,[_,h,m,e("ul",null,[e("li",null,[e("p",null,[p,e("a",g,[f,o(n)]),w,o(s,{to:"/maturity-model/service-ecosystem/virtual-network-service.html"},{default:a(()=>[k]),_:1}),b])]),e("li",null,[e("p",null,[y,o(s,{to:"/maturity-model/service-ecosystem/virtual-machine-service.html"},{default:a(()=>[v]),_:1}),x,e("a",B,[S,o(n)]),V])])])],64)}var A=r(u,[["render",C]]);export{A as default};