--- title: The Bastion Host Was a Good Idea in 2010 | daily.dev description: Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern... canonical: https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Bastion Host Was a Good Idea in 2010 | daily.dev og:description: Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern... og:url: https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz og:image: https://api.daily.dev/og/posts/wMWkXfOGZ.png og:image:alt: The Bastion Host Was a Good Idea in 2010 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Bastion Host Was a Good Idea in 2010 **[strongdm](https://daily.dev/sources/strongdm)** · 9 min read · 47 upvotes · 0 comments ## Summary Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern hybrid cloud environments with ephemeral resources, multiple accounts, and Kubernetes clusters have broken the core assumptions behind the bastion model. Three key problems emerge: single point of failure, lack of identity-aware auditing (only a shared hop, not per-user attribution), and ongoing maintenance burden. Adding a secrets vault like AWS Secrets Manager helps with credential hygiene but leaves a 'last mile' integration gap requiring custom glue code. StrongDM is presented as a solution that integrates directly with existing vaults, pulling credentials just-in-time into sessions without exposing them, while providing full identity-aware session recording — eliminating both the bastion and the homegrown integration layer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The Bastion Host Bill Nobody Sends to Finance](https://daily.dev/posts/the-bastion-host-bill-nobody-sends-to-finance-xkjohqq3n) · strongdm · 0 upvotes · 0 comments - [Non-Human Identities & Secrets Sprawl: Why Vaults Aren’t Enough](https://daily.dev/posts/non-human-identities-secrets-sprawl-why-vaults-aren-t-enough-rxjas92ic) · strongdm · 5 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#strongdm](https://daily.dev/tags/strongdm) [View this post on daily.dev](https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Bastion Host Was a Good Idea in 2010","url":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz"},"datePublished":"2026-07-24T00:30:41.193Z","dateModified":"2026-07-24T12:17:35.623Z","description":"Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d94e847707bd4dfad18121bf8f52a2f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d94e847707bd4dfad18121bf8f52a2f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"strongdm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"strongdm","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e72a1ea8a0264b83be7c0e7fce380f12","url":"https://daily.dev/sources/strongdm"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":47},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,strongdm","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"strongdm","item":"https://daily.dev/sources/strongdm"},{"@type":"ListItem","position":3,"name":"The Bastion Host Was a Good Idea in 2010"}]} ```