Cloud Architecture

Zero Trust Bastion via AWS Systems Manager

Cloud Architecture diagram · made in Skemio

Architecture diagram showing an engineer authenticating via IAM to AWS SSM, which connects outbound through a VPC Endpoint to a Private EC2 instance without inbound ports.
Architecture diagram showing an engineer authenticating via IAM to AWS SSM, which connects outbound through a VPC Endpoint to a Private EC2 instance without inbound ports.
Open it in SkemioMake your own

What it shows

  • SSM Session Manager uses outbound HTTPS on port 443 to AWS endpoints.
  • Zero inbound Security Group rules needed on private EC2 instances.
  • IAM controls access with full session auditing piped to S3 and CloudWatch.

The takeaway

Eliminate traditional bastion jump boxes by tunneling terminal sessions through AWS SSM over IAM.

More cloud architecture diagrams