Cloud Parts

Remote access

How people, scripts and AI agents reach private servers and databases without a public IP or a shared VPN.

3 technologies on this page ↓
Live model
What you’re watchingAn engineer and a CI job or AI agent sign in and get one proxied session each to a private host or database. A stolen laptop with an expired token is refused at the proxy. Every session is written to the audit log.

How it works

Private servers and databases sit in subnets with no public IP. Rather than putting a person on the whole network with a VPN, an access service stands in front. The caller (an engineer, a CI job, an AI agent) signs in with single sign-on, the service checks that this identity may reach this one host or database right now, and then proxies a single connection to it, often through a local port on the caller’s machine. A connector or agent inside the private network usually dials out to the service, so no inbound firewall rule is needed. Credentials can be issued for the session and expire with it, and each session is logged or recorded.

Think of it as

A front desk instead of a master key. You show your badge, the desk lets you into the one room you booked, the visit goes in the log, and your temporary pass stops working when you leave.

Reach for it when

  • Engineers need a shell on servers or a SQL prompt on databases in private subnets
  • Replacing a shared bastion host whose SSH key has been copied to every laptop
  • Contractors, CI jobs or AI agents need time-limited access to one system, not the whole network
  • Auditors ask who connected to production, when, and what they did there

Think twice when

  • Service-to-service traffic inside your system: that belongs on private networking and load balancers
  • Bulk data copies and replication, where every byte would squeeze through the proxy
  • Giving servers a public IP and opening port 22 to the internet “just for now”

A real example

An on-call engineer signs in with SSO and MFA and asks for the orders-db target. The access service creates a database user that expires in one hour, opens a tunnel to a local port, and logs the session. The database has no public IP, and its firewall only accepts the connector. A laptop presenting an expired token is refused before any packet reaches the subnet.

Technologies

Specific products, and what each does differently.

What each provider calls it

AWS
Systems Manager Session Manager, EC2 Instance Connect Endpoint, Verified Access
Google Cloud
Identity-Aware Proxy (TCP forwarding), OS Login
Azure
Azure Bastion, Microsoft Entra Private Access
Open source & others
OpenSSH ProxyJump, HashiCorp Boundary (BUSL), Teleport (AGPL source; Community Edition binaries limited to small companies)

In code · bash

# 1. Classic jump host: hop through one hardened bastion (OpenSSH 7.3+)
ssh -J ops@bastion.example.com admin@10.0.2.15

# 2. AWS: no bastion, no inbound port; the SSM Agent on the instance dials out
aws ssm start-session --target i-0abc1234def567890 \
    --document-name AWS-StartPortForwardingSessionToRemoteHost \
    --parameters '{"host":["orders-db.internal"],"portNumber":["5432"],"localPortNumber":["15432"]}'
psql "host=localhost port=15432 dbname=orders user=analyst"

# 3. Google Cloud: IAP checks your identity, then tunnels to a VM with no external IP
gcloud compute ssh app-1 --zone=europe-west1-b --tunnel-through-iap

Often confused with

Identity & access (IAM)AuthenticationVirtual private cloudsSecrets management
Where it came from2014–2026

Early firewalls let almost nothing in from the internet, so administrators picked a few machines to be the way through. Marcus Ranum’s paper “Thinking About Firewalls” named them bastion hosts, after the fortified corners of a medieval castle: systems that get extra hardening and regular audits. For decades the pattern stayed the same. Engineers connected to a bastion or jump box, or joined a VPN, and from there could reach whatever the network allowed.

In 2014 Google described BeyondCorp, its move away from a privileged internal network: because once the perimeter was breached, an attacker had relatively easy access to everything inside. Google put its corporate applications behind an access proxy that checks the user and the device on every request, and later extended that proxy beyond the web to protocols such as SSH. In 2020 NIST’s zero trust architecture (SP 800-207) turned the idea into guidance: no implicit trust from network location, and authentication and authorization before each session.

The clouds then built the same idea into their consoles. AWS Systems Manager Session Manager (2018) gave shells without inbound ports, bastions or SSH keys, Google’s Identity-Aware Proxy carried TCP connections inside HTTPS and checked IAM before forwarding them, and Azure Bastion and EC2 Instance Connect Endpoint reached machines without public IPs. Tools like HashiCorp Boundary and Teleport added per-session credentials and session recording, and are now being pitched as the gate for AI agents that need infrastructure access.

Why it’s built this way

One hardened entry point instead of exposing every server
Defending one well-watched machine is easier than defending dozens. The bastion host got extra security attention, audits and modified software so the servers behind it didn’t have to face the internet.
Decide per request from user and device, not from the network
A VPN or flat internal network trusts anyone who gets inside. BeyondCorp and zero trust check each request’s identity and device, so a stolen VPN login no longer opens everything.
Connectors that dial out instead of ports that listen
An agent or worker inside the private network opens an outbound connection to the access service, so the network needs no inbound firewall rule and the hosts need no public IP.
Credentials issued for the session, not shared keys
A shared SSH key or database password outlives the people who know it. Credentials tied to an identity and a session expire on their own and show up in the audit log under a name.

Timeline

  1. 2014

    Google’s BeyondCorp paper drops the privileged corporate network

  2. 2016

    OpenSSH 7.3 adds ProxyJump (ssh -J) for hopping through bastions

  3. 2018

    AWS Session Manager: shell access without inbound ports, bastions or SSH keys

  4. 2020

    NIST publishes SP 800-207 Zero Trust Architecture; HashiCorp announces Boundary

  5. 2023

    EC2 Instance Connect Endpoint reaches instances without public IPs

  6. 2026

    Access tools add controls for AI agents reaching infrastructure

Sources17

Improve this page on GitHub