Sold by: Fromkos
Deployed on AWS
Free Trial
Bastion Config provides PostgreSQL certificate authentication and approved, just-in-time read-only DBA diagnostics for self-managed PostgreSQL 18 on EC2 in your AWS account. Supported applications connect without a database password. You operate the installation; AWS infrastructure charges apply separately, including during the software trial.
Overview
Image
A protected perimeter around your PostgreSQL
Image
Passwordless PostgreSQL access with mTLS
Image
Sealed until a custodian unlocks it
Image
Backups and point-in-time recovery in your S3
Image
One CloudFormation stack in your own VPC
Image
Secure Production Diagnosis
Video
Product video
Bastion Config provides PostgreSQL certificate authentication and certificate management for self-managed PostgreSQL 18 on EC2 in your AWS account. Supported applications connect with client certificates instead of database passwords. Documented integrations include Java, TypeScript/Node and Rust; confirm your runtime, driver and renewal behavior before evaluation. RDS, Aurora and other managed PostgreSQL services are outside the current supported scope. Revocation blocks new application connections after the change reaches PostgreSQL; it does not instantly terminate established sessions. A new client certificate defaults to 30 days and renews automatically; before issuing one, the console warns when no application using that database user has shown it renews, and the key administrator may then choose up to one year. Existing certificates keep their lifetime. New server certificates default to 90 days. Evaluate rotation with both existing and new connections.
For database privileged access, Secure Production Diagnosis gives a DBA an approved, time-boxed diagnostic window. A separate domain administrator approves with a hardware security key. The DBA works in the Bastion console without receiving a standing database credential through this workflow. Only policy-permitted SELECT and EXPLAIN statements run under a prepared read-only database role; EXPLAIN ANALYZE is excluded. Activity and Locks panels and CSV export require policy permission. Requests, approvals, statements and exports are audited; returned rows are not copied into the audit trail. Permitted data is visible to the DBA and may be exported when allowed. This is not a data-loss-prevention tool. The Marketplace subscription includes one DBA_DIAGNOSTICS administrator.
Release 0.2.467 uses hardware-key setup and unlock; setup requires two different supported FIDO2/PRF keys, and passphrase unlock is unavailable. Separate roles and configured approval policies support operational control. Administrators finish their first sign-in with a temporary password they must change; an administrator who has registered a hardware security key can then sign in with the key and its PIN alone, with no login name or password. Audit evidence and optional configured S3 Object Lock checkpoints support review; they are not regulatory certification. The reference deployment supports WAL archiving, scheduled base backups and point-in-time recovery using your S3 storage. Availability depends on deployment method; confirm your configuration and exercise recovery in non-production. You own monitoring, retention, access decisions and recovery. No continuity, recovery success, RTO or RPO guarantee is implied. Email support is in English, Monday-Thursday during US Pacific working hours, with a first-response target of five business days and no SLA or 24/7 coverage. Start with one supported non-production application and agreed pass/fail evidence. Review current purchase and trial terms on AWS Marketplace; AWS infrastructure charges apply separately, including during the 30-day software trial.
Highlights
- PostgreSQL certificate authentication: supported applications connect without a database password. Evaluate your runtime and driver; revocation blocks new connections after propagation, while established sessions need separate consideration.
- Just-in-time read-only DBA diagnostics: a separate administrator approves a bounded window. SQL, diagnostic panels and CSV exports are restricted by policy. One DBA_DIAGNOSTICS administrator is included.
- Self-managed PostgreSQL 18 on EC2 in your AWS account. The reference deployment supports S3 backups and PITR; availability depends on deployment method. You own operations and recovery drills; AWS infrastructure charges are separate.
Details
Sold by
Categories
Delivery method
Delivery option
Bastion Config - CloudFormation stack in your VPC
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 30 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.small | $0.40 |
t3.medium | $0.40 |
t3.large | $0.40 |
m6i.large | $0.40 |
Dimensions summary
You pay by the hour based on the EC2 instance size you pick when launching the stack. The four options—t3.small, t3.medium, t3.large, and m6i.large—represent progressively more compute for the single bastion instance that runs the software. t3.small is the default. These are not feature tiers; each size delivers the same capabilities and differs only in the compute capacity backing it. Software charges are billed hourly by AWS alongside separate AWS infrastructure costs such as EBS storage, the load balancer, and any attached PostgreSQL hosts, which you size yourself.
Top-of-mind questions for buyers
Each hour meters the single bastion instance running the software, sized by the instance type you select at launch. The default is t3.small. You run one bastion instance per stack. Attached PostgreSQL hosts are separate EC2 instances you size and pay for apart from this software charge.
Hourly software charges accrue while the instance runs. Cancelling the Marketplace subscription does not terminate a running instance, so verify the instance is stopped to end charges. The data volume and backup bucket are retained on purpose and must be deleted by you.
You pay separately for AWS infrastructure: the EC2 instance, EBS data volume, a load balancer, a private hosted zone, and logs. A NAT gateway and backup bucket may also apply. Each attached PostgreSQL host is its own EC2 instance you size yourself.
www.fromkos.com+1
Helpful?
Vendor refund policy
Hourly usage is billed as used and is not refundable; the 30-day free trial lets you evaluate first. Annual subscriptions canceled within 30 days of purchase are refunded in full; after that, refunds are pro rata for unused full months. To request a refund, email bastion-config@fromkos.com with your AWS account ID and agreement ID; approved refunds are processed through AWS Marketplace.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Bastion Config - CloudFormation stack in your VPC
Deploys Bastion Config into an existing VPC in your account: the instance runs in a private subnet behind an Application Load Balancer that accepts HTTPS only from the CIDR you choose. The stack creates the ACM certificate and Route 53 records, one least-privilege IAM role, CloudWatch log groups (the audit group is retained when the stack is deleted), a data volume retained across instance replacement and stack deletion, and a versioned S3 bucket for PostgreSQL WAL archives and base backups. Requires a VPC with two private and two public subnets and a public Route 53 hosted zone.
CloudFormation Template (CFT)
AWS CloudFormation templates are JSON or YAML-formatted text files that simplify provisioning and management on AWS. The templates describe the service or application architecture you want to deploy, and AWS CloudFormation uses those templates to provision and configure the required services (such as Amazon EC2 instances or Amazon RDS DB instances). The deployed application and associated resources are called a "stack."
Version release notes
What changed since v.0.2.475:
Backup and restore: a Bastion backup now also includes installation secrets, not only the database. Take a new backup after upgrading.
Sessions: every restart or upgrade of Bastion now signs out all console sessions; sign in again afterwards.
Console: sign-in, domain and maintenance-mode fixes; the console now says when Bastion is in maintenance instead of showing a network error.
Access control: sign-in hardening.
Hardening: operator messages and logs tightened.
Reliability: more efficient database connection use under load.
Attached PostgreSQL: Bastion protects only a PostgreSQL cluster it creates and never takes over an existing database; documentation and console guidance updated to match.
CloudFormation template: descriptions reworded and comments removed; no resource changes.
Upgrading from v.0.2.475: download a Bastion backup and write down the stack's current AppImage. Upgrade the agent on every attached PostgreSQL host first (runbook 9 in /usr/local/share/bastion/docs/RUNBOOKS.md); on a host attached before v.0.2.473 this restarts PostgreSQL, so plan a maintenance window. Then update the stack with this version's template: the console pre-fills your current values, so set AppImage and ImageId to the values their descriptions name and leave the rest. The instance is replaced and keeps its data volume. When the update completes, run sudo systemctl restart bastion over Session Manager and unlock; the restart signs out every console session. Check the version on the About page, then take a new backup.
Additional details
Usage instructions
Guides: https://fromkos.com/docs/deployment , https://fromkos.com/docs/aws-resources
BEFORE YOU LAUNCH (same Region)
- A VPC: two private subnets (NAT egress), two public ones, each pair in two AZs.
- A public Route 53 hosted zone (console record + ACM).
- AllowedCidr: who may reach the console.
- Two different hardware security keys (YubiKey 5 / FIDO2 with PRF) to unlock.
- Session Manager access (no SSH).
PARAMETERS: keep ImageId and AppImage defaults. The first name in PostgresDbUsers becomes the database owner.
FIRST SIGN-IN
- Wait for CREATE_COMPLETE (up to 30 min).
- Run the FirstRunSecrets output command: aws ssm start-session --region <region> --target <instance-id> sudo head -n 20 /opt/bastion/configs/setup_token /opt/bastion/configs/admin_pwd setup_token claims the installation (30 min; lapsed: sudo systemctl restart bastion, read again); admin_pwd: admin's temporary password.
- Open ConsoleUrl. Bastion starts sealed: run the setup ceremony with your keys, then sign in as admin and replace admin_pwd. Once admin registers a security key, it and its PIN alone sign admin in.
- Attach PostgreSQL: the attach panel command builds a new PostgreSQL 18 cluster Bastion owns; approve each host. It never adopts an existing database: move data in with your own tools.
IAM: ONE role (InstanceRole), assumed only by this instance:
- AmazonSSMManagedInstanceCore: Session Manager access (no SSH).
- bastion-parameters: read/write only /bastion/pki/* (agent PKI exchange); read only this stack's image pin.
- bastion-attach-own-volume: ec2:DescribeVolumes, ec2:DescribeSubnets (ALB subnets, trusted for X-Forwarded-For); ec2:AttachVolume only on this stack's tagged volume and instance.
- bastion-logs: write only /bastion/<stack>/* log groups (incl. audit); read back only the audit group.
- bastion-notifications: sns:Publish (bastion-* topics), ses:SendEmail, for alert channels you add.
- bastion-audit-export (only with AuditExportBucket): s3:PutObject and two bucket reads, for the locked audit copy. No other role, user or key; it cannot read your S3 buckets or call KMS, IAM or Marketplace. Alarm EC2 actions use the service-linked role AWSServiceRoleForCloudWatchEvents (created if absent).
KEYS: no KMS key is created; volumes use the default aws/ebs key. Bastion keeps its secrets encrypted on the EBS data volume, usable only after unlock. Only your operators hold what Bastion needs to unlock. First-run secrets stay on the instance. AWS and the seller hold none of these.
NETWORK: only the ALB is reachable, HTTPS 443 from AllowedCidr. PostgreSQL hosts reach the instance via BastionClientSecurityGroup.
INTERNET (outbound HTTPS): the instance pulls bastionsecurity/bastion-app from Docker Hub (pinned by digest) and Ubuntu packages; the attach command downloads the Terraform bundle from the seller's public S3 bucket (SHA-256 checked). Nothing connects to the seller at runtime.
UNRECOVERABLE BY DESIGN: the EBS data volume (identity, CA, database) and your operators' unlock keys. Stack deletion RETAINS the volume, backup bucket and audit log group. Back both up before production.
MONITORING: CloudWatch alarms (EC2 status, ALB target health, 5xx, latency), a dashboard; AlarmTopicArn (SNS) for notices. Failed status checks recover or reboot EC2; it returns sealed.
UPDATES: back up first. With PostgreSQL attached, upgrade the agent FIRST (runbook 9, /usr/local/share/bastion/docs/RUNBOOKS.md). Update the stack to the new template; set AppImage and ImageId to the values their descriptions name, not the pre-filled ones. A new ImageId replaces the instance, not the data volume. It returns sealed: unlock. Old version on About, or only AppImage changed? sudo systemctl restart bastion, unlock again.
REMOVAL: delete the stack; decide on retained resources. Unsubscribing does not terminate instances.
SUPPORT: bastion-config@fromkos.com , Mon-Thu, US Pacific Time; include your account ID.
Resources
Vendor resources
Support
Vendor support
Email: bastion-config@fromkos.com Documentation: https://fromkos.com/docs/overview Support page: https://fromkos.com/docs/support Security issues: email bastion-config@fromkos.com , subject "Security". Policy: https://fromkos.com/docs/security?src=other_external&campaign=none Accessibility: https://fromkos.com/docs/accessibility (statement and VPAT/ACR for console 0.2.454)
Support is by email, in English, Monday to Thursday during US Pacific Time working hours. Include your AWS account ID and the CloudFormation stack name so we can identify your subscription.
Target first response: 5 business days (Monday-Thursday). This is a response target, not an uptime, incident-response, or fix-time guarantee. There is no SLA and no 24/7 coverage.
Covered:
- Launching and configuring the product with the supplied CloudFormation template, on the instance types it offers.
- The sealed setup and unlock ceremony, domain and administrator setup, certificate issuance, and attaching a PostgreSQL database.
- Backup, restore, and point-in-time recovery using the documented procedures.
- Bug reports against the current version, with logs, versions, and steps to reproduce.
- Subscription and entitlement questions.
Not covered:
- Operating your installation, production incident response, or guaranteed fix times.
- Custom topologies, custom integrations or code changes.
- Your AWS account, networking, IAM, or charges billed by AWS.
- Review of unredacted secrets. Never send private keys, unlock shares, or secret values.
Two things nobody can recover for you: the data volume the stack creates (it holds the installation's identity, certificate authority, and control-plane database, and deliberately survives instance replacement) and the unlock shares handed out during setup. By design, we can't reconstruct either. Back both up before production.
Refunds are handled through AWS Marketplace under the refund policy on this listing.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
DBLab Standard Edition (DBLab SE) delivers fast, cost-effective database cloning, enabling agile teams to create instant, full-size production clones for development, testing, and staging, all managed like code, integrated into CI/CD pipelines, and optimized with transparent pricing.
Support and services for our BastionLinux/PostgreSQL marketplace offering.
Next Level3's Just-In-Time (JIT) Access is a top MultiFactor Authentication (MFA) solution, providing superior AWS environment protection against unauthorized access and breaches. Seamlessly integrating with AWS Cognito and IAM, it delivers advanced Identity Verification and robust MFA, surpassing traditional IAM systems.
Our solution addresses key use cases: securing dormant accounts, managing employee transitions, protecting endpoints, legacy, and IoT devices, and offering robust security for cloud-hosted systems and custom applications.
With white-label MFA capabilities, Next Level3's JIT Access integrates with your brand. As a secure, reliable, and versatile IAM solution countering a wide range of cyber threats, choose Next Level3's JIT Access for unmatched AWS security and superior MFA and Identity Verification solutions.
Bastion Technologies is the all in one Service-as-a-software solution (cybersecurity & compliance SaaS platform + service) dedicated to SaaS, tech and AI startups and scale-ups to get compliant (SOC 2, ISO 27001, C5, GDPR etc.) and secure fast and smooth.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.