Topic

Network ingress hardening

Reducing or removing inbound network exposure on hosts by using agent-initiated outbound connections, private subnets and brokered access instead of open ports and allowlisted IP ranges.

Current clusters

build1 publisher

GitHub Actions deploys into a private EC2 instance through the SSM agent's outbound connection

The SSM agent holds a connection out to AWS, OpenSSH rides it as a ProxyCommand, and EC2 Instance Connect pushes a key that sshd forgets after 60 seconds, so the security group ingress list can stay empty.

Publishers:dev.to

Reality

Evidence45
Adoption10
Hype gap+28
Incentives85
Confidence40