Bastion in the cloud provides restricted connectivity and often provides just-in-time access to target resources that don't have public endpoints