7.8 NATs vs. Bastions
Last updated
Was this helpful?
Last updated
Was this helpful?
You have built both of them already. You built bastion server which we used as our web server at the beginning of this section, and then we created our NAT instances and NAT Gateways.
We will explore the difference between them. NAT instance was used to route traffic to EC2 instances that are sitting in our private subnet. So it is giving these instances Internet traffic. They are able to connect out through the Internet. But people within the Internet cannot use SSH or RDP to connect to our NAT and then connect into our instances to administer our servers. If you want to do that, you need to have a bastion host in the public subnet, which allows you to SSH or RDP into your bastion, and then initiate a private connection over the private network to your instances to administer them. Basically, Bastions are used just for administration only. If can lock down the SSH and RDP ports to your specific IP addresses so that only you can connect to the bastion server and administer it. You do that over a private network connection (e.g. VPN connection between your on-premises datacenter and AWS).
How to make a bastion instance highly available? With any kind of highly availability, you need multiple subnets. One subnet always equals to one AZ, and you always need at least two public subnets. You can have a bastion in each public subnet, and you could do things like auto-scaling groups so that if you have minimum of one bastion and if that bastion host goes down, the auto scaling group will deploy it into either one AZ or the other. And you can have Route53 running to do health check on that bastion server. So that is how you build out a highly resilient bastion network. With NAT instances, you do something similar, but you have to have some kind of script to automatically failover your NATs. But with NAT gateways, Amazon handle failover for you automatically.
A NAT is used to provide Internet traffic to EC2 instance in private subnets. So you can go and install MySQL or Apache httpd server.
A Bastion is used to securely administer EC2 instance (using SSH or RDP) in private subnets. Another name of Bastion is jump box, which means you jump onto that server and then once you are in there you can SSH or RDP from that server into your private subnets.
