You need a bastion for certain infrastructure types like AWS RDS' regardless of type (SQL Server, MYSQL) as an example. You can go direct to any EC2 hosted instance but it can get a little tedious on containers in Fargate or EC2 backed. The userspace that the Daemon runs on needs SOCKS magic to get working. Which eventually works but it's a PITA to get there and maintain.

So for our RDS instances and containers in ECR we use a bastion which IMO is a lot easier to manage.