Skip to main content
WarnHack
WarnHack
Use case · WarnHack Terminal

Replace the bastion host without losing control

Bastions concentrate risk: one box to harden, patch, back up, and explain to auditors. WarnHack Terminal gives mediated access and session logs as a managed product — so you are not on-call for the jump host.

Stop patching the jump box. Pilot Terminal on one environment this week.

The hidden cost of jump hosts

  • The bastion is a high-value target and a single point of failure
  • Patching, MFA, and user management become a second full-time product
  • Shared bastion logins reintroduce the same accountability problems as shared keys
  • AWS SSM helps only inside AWS — multi-cloud fleets still need something else
  • Open-source web bastions (e.g. Bastillion) shift ops burden onto your team

What replaces the bastion

  • Browser sessions with role-based access — no VPN-or-bastion ritual for every engineer
  • Full session and command audit without scraping bastion logs by hand
  • Instant revoke when someone leaves — no bastion account cleanup theater
  • Works across clouds and bare metal, not only one provider’s session manager
  • Clear story for customers: controlled access path with evidence

How Terminal retires the jump box

  1. 1

    Mediate access in the product

    CloudRelay sits in the access path so you get logs and control without maintaining a DIY bastion stack.

  2. 2

    Keep break-glass paths deliberately

    Many teams keep a narrow emergency path while interactive daily access moves to Terminal.

  3. 3

    Decommission with confidence

    After dual-run, remove public SSH where appropriate and shut down the jump host that only existed for human access.

Bastion replacement checklist

  • List who uses the bastion daily vs emergency-only
  • Pilot Terminal on a subset of hosts behind the bastion
  • Confirm audit captures the sessions compliance cares about
  • Update runbooks and onboarding to browser access
  • Reduce bastion user list; then decommission or lock to break-glass only
  • Document the new access path for SOC 2 / customer reviews

FAQ

Is a bastion still required for compliance?

Auditors care about controlled access and evidence — not that you own a jump VM. A managed access layer with logs often satisfies the control more cleanly.

How is this different from AWS Session Manager?

SSM is excellent inside AWS. Terminal is built for multi-cloud and bare metal with a team-friendly RBAC and human-readable audit UI.

Can we keep a bastion for emergencies?

Yes. Many teams dual-run, then leave a tightly controlled break-glass path while day-to-day access is Terminal.

Put this use case into production

Stop patching the jump box. Pilot Terminal on one environment this week.