A Bastion Host is a hardened EC2 instance deployed in a public subnet that provides secure administrative access to instances in private subnets. Administrators first connect to the Bastion Host and then access private resources. It acts as a secure jump server and prevents exposing private instances directly to the internet. In modern AWS environments, Session Manager is often preferred over traditional bastion hosts for enhanced security and manageability.