[Narrator] So now let's talk about Bastion Hosts.
So we have our VPC public subnets and private subnets.
And for now we created an instance in the public subnet
and we were able to SSH into it, okay.
But also we can create instances and do private subnets,
and we cannot SSH into them
because if we were to give the private subnet
access to the internet gateway,
then you would actually make these EC2 instances
public and that would defeat the point.
So the question is how do we connect to these instances
in our private subnets?
And the way to do so is to use the Bastion Host.
So a Bastion Host is an EC2 Instance in a public subnet,
and it's a bastion because we go through it, okay.
And what we have to do is edit the security group
rules of the EC2 Instance in the private subnets.
And what we have to do then is to allow the users to SSH
directly into the public subnet's Bastion Host,
the EC2 Instance,
and from the Bastion Host,
we're going to SSH
into the EC2 Instance of the private segment.
So there's a concept of the hop.
To hop through the bastion host into the private subnets.
And obviously,
if you had other EC2 instances in private subnets,
we could do it this way as well.
So the Bastion Host is a way for us to SSH
into our private Institute instances
from the internet and the Bastion Host,
is in the public of subnets.
And then the public subnet is connected
to all the private subnets.
Now the Bastion Host security group, of course,
must be tightened
because it has access to all your networks.
So make sure your centrals are correct.
And of course,
you need to also ensure that your EC2 instances
security groups are properly configured
to allow traffic from the Bastion Host.
So let's have a look
at how we can do it in the next lecture.