Azure Bastion and its equivalents in AWS and GCP

Modern cloud providers offer secure alternatives to traditional bastion hosts and public SSH/RDP access. These solutions reduce the attack surface by eliminating the need to expose administrative ports directly to the Internet while still providing secure access to virtual machines and workloads.

Feature	Azure Bastion	AWS SSM Session Manager	GCP Identity-Aware Proxy (IAP)
Architecture	Dedicated Platform-as-a-Service (PaaS) proxy instance deployed within a dedicated subnet inside the Azure Virtual Network.	Platform API endpoints communicate with instances through the AWS Systems Manager Agent installed on the operating system.	Identity-aware proxy service built directly into Google's global network infrastructure.
Inbound Ports Required	Port 443 (HTTPS) must be open on the Bastion service. Ports 22 (SSH) and 3389 (RDP) remain accessible only internally.	None. All inbound administrative ports can remain completely closed.	Only Google's internal IAP address range 35.235.240.0/20 requires access.
Access Methods	Azure Portal (Browser-Based Access) Azure CLI Native SSH Client Native RDP Client	AWS Console AWS CLI Session Manager Plugin SSH Tunneling via Session Manager	Google Cloud Console gcloud CLI Native SSH Clients TCP Forwarding Through IAP
Primary Cost Model	Hourly infrastructure charges apply (except when using certain entry-level or developer-focused SKUs).	Free for standard EC2 administrative access through Session Manager.	Free for standard TCP forwarding and administrative access scenarios.

High-Level Comparison

✓ Azure Bastion

• Provides browser-based SSH and RDP access.
• Requires a dedicated managed Bastion resource.
• Ideal for organizations heavily invested in Azure networking.

✓ AWS SSM Session Manager

• Requires no inbound SSH or RDP ports.
• Uses the AWS Systems Manager Agent.
• Often considered the most secure and operationally simple approach.

✓ Google Cloud IAP

• Integrates tightly with Google Identity and IAM.
• Provides secure TCP forwarding without exposing public endpoints.
• Well suited for zero-trust administrative access models.

⚠ Security Observation

AWS Session Manager and Google Cloud IAP allow administrators to keep SSH (22) and RDP (3389) ports completely closed to the Internet, significantly reducing the external attack surface compared to traditional bastion-host architectures.

Note

The solution that most closely aligns with a Zero-Trust architecture:

• AWS: SSM Session Manager
• Google Cloud: Identity-Aware Proxy (IAP)
• Azure: Azure Bastion (combined with Azure AD and Private Networking)

Azure VPN (Point-to-Site) vs Azure Bastion

Both Azure VPN (Point-to-Site) and Azure Bastion provide secure access to resources inside an Azure Virtual Network (VNet), but they are designed for very different use cases.

Feature	Azure VPN (P2S)	Azure Bastion
How it Connects	Encrypted VPN tunnel from your local device directly into the Azure VNet.	Secure HTTPS-based RDP/SSH session delivered through the Azure Portal.
Access Scope	Full network-level access to VMs, databases, internal APIs, storage accounts, and other private resources within the VNet.	Access limited to a specific VM session via RDP or SSH.
Client Software	Requires the Azure VPN Client (or another supported VPN client).	No client installation required; operates directly through the Azure Portal.
Best Used For	Developers, administrators, and applications that require ongoing access to multiple private Azure resources.	Quick administrative tasks, troubleshooting, and secure VM management.

Azure VPN (P2S): Best when you need continuous access to an entire private network and its services.

Azure Bastion: Best when you only need secure browser-based RDP/SSH access to virtual machines without exposing management ports to the Internet.

Rule of Thumb: Use Azure VPN when you need network access. Use Azure Bastion when you only need secure VM access.