I don’t currently understand the additional security from bastion hosts. Yes you can have them short lived. But if someone cracks the bastion it’s not very good for security.

I think it’s better with VPN plus SSM.