It died the slow death of every brittle, manual, single‑point gateway before it. Now, teams running workloads in a VPC private subnet need a faster, safer, and simpler way to give engineers access without keeping a publicly exposed jump box alive. The replacement is not a bigger bastion host. It’s a lightweight, ephemeral proxy deployment that vanishes when it’s not in use.
A VPC private subnet proxy deployment removes the public endpoint entirely. You turn on secure, zero‑trust access at the network edge. No static IPs. No permanent attack surface. The proxy spins up only when traffic needs to flow to your private resources. Tear it down and it’s like it was never there.
With this design, you avoid storing SSH keys on developer laptops. You cut the admin overhead of patching and rotating credentials on a shared bastion. Every connection is authenticated, logged, and authorized in real time. Policies can be tied directly to user identity and group membership, not to IP ranges or subnet whitelists that rot over time.
Deploying a bastion host replacement is also faster than you think. A containerized proxy runs inside the private subnet. It connects outbound through a single, controlled egress path. You can run it on ECS, EKS, or any compute element inside your VPC. Pair it with an identity‑aware access layer and you have end‑to‑end encryption, isolated routes, and completely private workloads with no exposed ports.