Building a Secure Two-Tier Network on AWS Using a Bastion Host
Introduction
For my AWS networking assessment, I built a two-tier network using Amazon Virtual Private Cloud (Amazon VPC). The goal was to place a bastion host in a public subnet and a second EC2 instance in a private subnet. This design allows administrative access to the private server without exposing it directly to the public internet.
What Is a Bastion Host?
A bastion host, also called a jump box, is a server that acts as a controlled entry point into a private network. Administrators connect to the bastion host first and then use it to reach internal servers. It reduces the need to expose private instances to direct internet access and makes it possible to restrict administrative access to a specific entry point.
A bastion host should be secured carefully. For example, SSH access can be restricted to a trusted public IP address, and private instances can be configured to accept SSH only from the bastion host’s security group.
How I Built My Network
I created a VPC named assessment-vpc in the Europe (Ireland) AWS region (eu-west-1) with the IPv4 CIDR block 10.0.0.0/16. I created two subnets in the same Availability Zone, eu-west-1a: assessment-public-subnet using 10.0.1.0/24 and assessment-private-subnet using 10.0.2.0/24.
Get Obileye Oluwadurotimi’s stories in your inbox
Join Medium for free to get updates from this writer.
I attached an Internet Gateway named assessment-igw to the VPC. I configured assessment-public-rt with a default route (0.0.0.0/0) to the Internet Gateway and associated it with the public subnet. The private route table, assessment-private-rt, retained only the local VPC route and was associated with the private subnet. I did not create a NAT Gateway.
Next, I launched two Amazon Linux 2023 EC2 instances using the t3.micro instance type. The bastion instance received a public IP address, while the private instance had no public IP address.
I configured the bastion security group to allow SSH over TCP port 22 only from my public IP address. The private instance’s security group allowed SSH on port 22 only from the bastion security group, rather than from a public IP range.
Finally, I connected from my Windows PC to the bastion using SSH. I enabled SSH agent forwarding and then connected from the bastion to the private instance using its private IP address. I did not copy my private key onto the bastion.
Problems I Encountered and Solutions
One challenge was that the first ProxyJump attempt returned a public-key authentication error. I tested a direct SSH connection to the bastion using the correct PEM key and confirmed that the key and bastion access worked.
I then discovered that the Windows OpenSSH Authentication Agent service was disabled. I enabled the service in an Administrator PowerShell session, started it, and added my PEM key using ssh-add. I connected to the bastion with agent forwarding enabled and then successfully connected to the private instance using its private IP address.
This exercise helped me understand how subnet routing, security groups, SSH keys, and bastion hosts work together to provide controlled access to private cloud resources.
Conclusion
The completed network demonstrates a simple two-tier architecture in AWS. The public subnet contains the controlled administrative entry point, while the private subnet contains an instance without a public IP address. Restricting SSH access through security groups and using SSH agent forwarding helps reduce unnecessary exposure of private infrastructure.
