Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern hybrid cloud environments with ephemeral resources, multiple accounts, and Kubernetes clusters have broken the core assumptions behind the bastion model. Three key problems emerge: single point of failure, lack of identity-aware auditing (only a shared hop, not per-user attribution), and ongoing maintenance burden. Adding a secrets vault like AWS Secrets Manager helps with credential hygiene but leaves a 'last mile' integration gap requiring custom glue code. StrongDM is presented as a solution that integrates directly with existing vaults, pulling credentials just-in-time into sessions without exposing them, while providing full identity-aware session recording — eliminating both the bastion and the homegrown integration layer.
