Single service comparison

Huawei CBH is a dedicated bastion instance (a jump host appliance) you purchase by edition and asset tier, whereas Session Manager is an agent-and-broker service with no customer-managed bastion VM. CBH requires network reachability to managed hosts and reuses their own credentials or proxied accounts; Session Manager's SSM Agent establishes outbound control channels, so hosts need no inbound ports and can sit behind NAT. This changes network design: CBH assumes VPC/LAN connectivity to assets, while Session Manager assumes only outbound HTTPS to the SSM endpoint.

Audit and identity models differ materially. CBH captures full session video replay, command logs, and database O&M audit on its own data disk, with MFA and remote authentication to third-party IdPs; Session Manager emits session metadata and command text to CloudTrail/CloudWatch/S3 but does not record graphical screen replay. AWS identity is IAM/Identity Center with fine-grained resource-level permissions; CBH maps users and roles inside its own RBAC plus Huawei IAM for console access, and uses multi-level approval for sensitive operations.

Scaling, HA, and pricing are not equivalent. Session Manager is serverless and elastic with per-node-metered billing plus storage costs; CBH capacity is fixed per instance SKU (50-10,000 assets, 50-500+ concurrent connections) with yearly flat pricing by edition, requiring pre-sized concurrency and HA planning. There is no native CBH equivalent to Session Manager's port-forwarding tunneling through the broker, and cross-account/cross-region brokering must be handled with VPC peering or VPN rather than agent tunneling.

Assess current SSM Session Manager usage: count managed nodes, peak concurrent sessions, command/port-forwarding reliance, audit retention, and identity provider. Map AWS IAM/Identity Center users and resource-level policies to Huawei IAM plus CBH users and roles, and select a CBH edition (standard for SSH/RBAC audit, professional if you need automated O&M and database audit) and an asset tier sized for peak concurrency, not just host count.

Re-create the access surface in CBH rather than migrating configuration directly: import host and database assets, register or rotate managed credentials, define access control policies, command filters, and multi-level approval rules, and configure MFA plus remote authentication to your IdP. Because CBH brokers through the bastion VM, plan VPC/peering/VPN connectivity so the CBH instance can reach private hosts where Session Manager previously relied on outbound agent tunnels.

Rebuild logging and compliance pipelines: point CBH audit export to OBS for long-term retention equivalent to S3/CloudWatch destinations, and replace CloudTrail/CloudWatch alerting with CTS and CES/LTS where needed. Validate session brokering, command audit replay, database sessions, and any automated O&M playbooks, then cut over environment-by-environment with parallel running until audit evidence and MFA flows are confirmed.

Mind the gaps and cost-model shift. There is no one-click migration and no exact port-forwarding equivalent; custom SSH tunneling through CBH or supplemental ECS-based jump hosts may be required for tunnel use cases. Pricing moves from metered per-node-plus-storage to flat yearly edition-plus-asset-tier billing, so recalculate TCO against concurrent-session peaks, data-disk growth for recordings, and any required HA via multiple CBH instances across AZs.