Your company currently has a set of web servers in a public subnet and database servers in the private subnet. You need to ensure administrators from your on-premises environment can access the database servers. Which of the following is a secure way to access the database servers?

Answer options:

A.Create a bastion host in the private subnet as the database servers. Ask the IT administrators to log into the database servers via the bastion host.
B.Create a bastion host in the public subnet. Ask the IT administrators to log into the database servers via the bastion host.
C.Create a NAT instance in the private subnet as the database servers. Ask the IT administrators to log into the database servers via the NAT Instance.
D.Create a NAT instance in the public subnet as the database servers. Ask the IT administrators to log into the database servers via the NAT Instance.

Answer – B
The AWS Documentation mentions the following.
A bastion host is a server whose purpose is to provide access to a private network from an external network, such as the Internet. Because of its exposure to potential attacks, a bastion host must minimize the chances of penetration. For example, you can use a bastion host to mitigate the risk of allowing SSH connections from an external network to the Linux instances launched in a private subnet of your Amazon Virtual Private Cloud (VPC).
Option A is incorrect since the bastion host needs to be in the public subnet.
Options C and D are incorrect since the NAT instance should not be used as a jump server to the database servers.
For more information on using a bastion host, please refer to the below URL-
https://aws.amazon.com/blogs/security/how-to-record-ssh-sessions-established-through-a-bastion-host/