[kainosnoema]

In either case—assuming you run a VPC—you usually configure one or more NAT instances to allow EC2 instances to communicate with the internet (http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NA...). I suppose a bastion could do double-duty as a NAT, but in most cases you want one per availability zone to add isolation and redundancy.

[jwilliams]

Doesn't this -somewhat- mitigate the advantage of having zero-surface area?

I'm using a Bastion setup, so don't get me wrong, just want to understand how strong the pros are for the VPN route.

On your last note. I just run one Bastion as a general rule. They're quick enough to spin up another instance (in a different AZ if necessary). Generally our services won't die if the Bastion or NAT is down.

[dbarlett]

You can also configure HA NAT with an ICMP heartbeat: https://aws.amazon.com/articles/2781451301784570