You work as an architect for a company. An application will be deployed on a set of EC2 instances in a private subnet of VPC. You need to ensure that IT administrators can securely administer the instances in the private subnet. How can you accomplish this?

Answer options:

A.Create a NAT gateway, ensure SSH access is provided to the NAT gateway. Access the Instances via the NAT gateway.
B.Create a NAT instance in a public subnet, ensure SSH access is provided to the NAT instance. Access the Instances via the NAT instance.
C.Create a bastion host in the private subnet. Make IT admin staff use this as a jump server to the backend instances.
D.Create a bastion host in the public subnet. Make IT admin staff use this as a jump server to the backend instances.

Answer – D
The AWS Documentation mentions the following.
A bastion host is a server whose purpose is to provide access to a private network from an external network, such as the Internet. Because of its exposure to potential attacks, a bastion host must minimize the chances of penetration. For example, you can use a bastion host to mitigate the risk of allowing SSH connections from an external network to the Linux instances launched in a private subnet of your Amazon Virtual Private Cloud (VPC).
Option A is invalid because you would not allow the inbound SSH access via the NAT gateway.
Option B is invalid because you would not allow the inbound access via the NAT instance.
Option C is incorrect since the bastion host needs to be in the public subnet.
For more information on bastion hosts, please visit the below URL-
https://aws.amazon.com/blogs/security/how-to-record-ssh-sessions-established-through-a-bastion-host/