The bastion host sat in the middle of the network like a leftover from another era.
It was once the answer to secure remote access. Now it slows teams down, adds cost, and still leaves too much surface area exposed. Static credentials, firewall gymnastics, manual key rotation. We accept them because they’re familiar, not because they’re good.
Replacing a bastion host isn’t just about turning off an old box. It’s about rethinking secure access from the ground up. Modern cloud environments demand an approach without a single choke point. No open ports. No SSH keys sitting on laptops. No silent drift from the intended security model. That’s where service accounts—properly scoped, automatically provisioned, instantly revoked—change the game.
Service accounts remove the interactive hop point entirely. Instead of logging into a bastion and then into a host, authorized processes connect directly using ephemeral credentials. These credentials live for minutes, not months. They’re bound to an identity and a purpose. They work without maintaining an always-on server in your VPC.