It took 27 minutes for the team to get a secure shell into production. Not because the code was broken. Not because the network was down. Because the bastion host was.
Bastion hosts have been the gatekeepers of private infrastructure for decades. They work. They also slow you down. They introduce maintenance overhead, extra credentials, and network complexity. They become single points of failure that nobody notices—until they fail.
There is a better way.
The Problem with Bastion Hosts
Bastion hosts live at the edge of your network, opening a single controlled door. But in practice, they need constant patching, firewall tuning, and identity management. Every service, every engineer, every deployment has to route through them. Scaling access means scaling pain. The more teams and environments you manage, the heavier the operational load becomes.
They were built for a different era. Today, infrastructure lives in code. Servers and clusters spin up and down in minutes. Security policies should match that pace—not wait on manual configurations or relay servers that sit outside automation pipelines.
Infrastructure as Code Access Control
The real alternative to a bastion host is a model where your access rules live alongside your deployments—declared, versioned, and enforced automatically. No extra hardware. No hidden servers. No separate authentication islands.
When access is defined as part of Infrastructure as Code, every environment carries its own precise entry rules. Your CI/CD can provision them. Your VPC and security groups stay tight. Identity comes from the same source of truth as every other system you run.
You roll forward and roll back access with the same commands that roll forward and roll back infrastructure. This eliminates drift. It removes the attack surface of a long-lived bastion. It ties permission to deployment, not to a static IP in a forgotten subnet.
Security That Moves as Fast as You Deploy
Traditional bastion models force you to align the speed of development with the slowness of network ops. Infrastructure as Code removes that bottleneck. It’s secure by design because rules are explicit and temporary. It’s reproducible. It’s testable. It works no matter how many environments, clouds, or regions you operate in.
A Live Alternative Without the Pain
You can see this today. No waiting for provisioning requests. No editing firewall ACLs by hand. No SSH key spreadsheets. Define your access policies in code and have them deploy with your stack.
With hoop.dev, you get ephemeral, policy-driven access in minutes, built right into your workflows. Watch it go live. Watch the bastion become obsolete.