Allowing external access to bastion hosts on aws

Question

I am trying to create a few bastion hosts in my VPC on aws to connect to my databases that are located in a private subnet. I am using this aws Quick start.

I understand the basics of CIDR blocks and what they mean. However, I don't understand what aws means by the "Allowed Bastion External Access CIDR" parameter. To quote the documentation, this parameter means the following:

"CIDR block that’s allowed SSH external access to the bastion hosts. We recommend that you set this value to a trusted CIDR block. For example, you might want to restrict access to your corporate network."

I don't understand what I should enter in this parameter. Do they want the IP range of my private subnet that will connect to the bastion hosts? Or do they mean by this the range of my private network at home? And does this mean that I can't ssh into my bastion hosts from anywhere else? Obviously I want to restrict access to my bastion hosts, but I don't think I want to only be able to access them from home, since I work from different places and we don't have a private network at the office.

Thanks

Answer 1

All computers on the internet have an IP address. A group of sequential IP addresses can be expressed as a CIDR block, of various sizes. For example 10.0.0.0/32 is a single IP address, 10.0.0.0, 10.0.2.0/24 is a group of 256 IP addresses from 10.0.2.0 to 10.0.2.255, etc. You can Google CIDR.

Generally you want to allow access to your bastions only to your work IP addresses, and potentially key staff's home IP addresses. This makes it more difficult for others to gain access to your bastions and network.

The block quoted below is just saying that you should add the CIDR range of the IP addresses you want to access your bastion to the security group, and block all other IP addresses.

"CIDR block that’s allowed SSH external access to the bastion hosts. We recommend that you set this value to a trusted CIDR block. For example, you might want to restrict access to your corporate network."