Re:Tailscale SSH
by dimitar on Wednesday June 22, 2022 @12:15PM
(#31837961)
Hmm AFAIK you don't need a bastion to use SSM agent - it even allows you access through the browser. I think you meant EC2 Instance Connect which manages temporary SSH keys.
[ Parent
| on HN ]
You need a bastion for certain infrastructure types like AWS RDS' regardless of type (SQL Server, MYSQL) as an example. You can go direct to any EC2 hosted instance but it can get a little tedious on containers in Fargate or EC2 backed. The userspace that the Daemon runs on needs SOCKS magic to get working. Which eventually works but it's a PITA to get there and maintain.
So for our RDS instances and containers in ECR we use a bastion which IMO is a lot easier to manage.