How to Use a Bastion Host to Access Private EC2 Instances | AWS VPC Demo
👉 View the full AWS Networking Deep Dive course here:
https://www.udemy.com/course/aws-netw...
In this video, I demonstrate how to use a bastion host (also called a jump box) to securely connect to EC2 instances running inside a private subnet in an AWS VPC. Since private subnets do not assign public IP addresses, they cannot be accessed directly from the internet. Instead, we route traffic through a public-facing EC2 instance and “jump” into the private instance.
This demo walks through the entire process step-by-step:
• Launching a private EC2 instance with no public IP
• Understanding why you cannot connect to it from the internet
• Using a Windows EC2 instance in the public subnet as a bastion host
• Verifying communication using PowerShell and private IP connectivity
• Reviewing security group behavior and why this setup works
• Seeing how AWS routing handles communication between subnets
• Best practices for security groups and isolating your private workloads
This is an essential skill for AWS Solutions Architect, SysOps, and Developer certifications. Real-world AWS networks almost always use bastion hosts—or SSM Session Manager—as the secure access method for private compute resources.
You’ll Learn:
• What a bastion host is and why organizations use them
• How private subnets block direct inbound access
• How security groups allow EC2-to-EC2 communication
• How local routing inside a VPC enables instance connectivity
• Why this pattern appears on AWS exams and real architectures
If you're building AWS skills or preparing for certification, mastering bastion hosts is a must!
#AWS #BastionHost #EC2 #AWSVPC #CloudNetworking #AWSForBeginners #LearnAWS #VPCSecurity