[jwilliams]

Doesn't this -somewhat- mitigate the advantage of having zero-surface area?

I'm using a Bastion setup, so don't get me wrong, just want to understand how strong the pros are for the VPN route.

On your last note. I just run one Bastion as a general rule. They're quick enough to spin up another instance (in a different AZ if necessary). Generally our services won't die if the Bastion or NAT is down.