Private Instance Access across clouds
Reaching a private instance without a public SSH port - Session Manager, Azure Bastion, IAP TCP forwarding, the OCI Bastion service - with the session recorded and the port closed.
4 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | Shell Access with No Bastion, and a Transcript | static-validated |
| Azure | Azure Bastion + Hardened Jumpbox | ✓ live-tested |
| Google Cloud | SSH without a Bastion, a Public IP, or an Open Port | static-validated |
| Oracle Cloud | Bastion Service | static-validated |
How to choose
Compare what the session is authenticated by (the cloud identity, not a key on a laptop), whether the session is logged as a transcript or only as a login event, and what the service costs when idle: some are a per-hour host, some bill nothing until a session opens. Then check that the module actually removes the inbound 22 rule rather than adding a second door.
When not to use
A bastion is a door, and the audit trail is the reason to use a managed one. If nobody reads the session logs, the managed service has bought you a closed port and nothing else.