Azure Network Bastion Host
This page shows how to write Terraform and Azure Resource Manager for Network Bastion Host and write them securely.
azurerm_bastion_host (Terraform)
The Bastion Host in Network can be configured in Terraform with the resource name azurerm_bastion_host
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_bastion_host" "bastion-spoke-1" {
name = "bastion-spoke-1"
location = var.location-spoke-1
resource_group_name = azurerm_resource_group.vwan-microhack-spoke-rg.name
ip_configuration {
resource "azurerm_bastion_host" "bastion-spoke-1" {
name = "bastion-spoke-1"
location = var.location-hub-1
resource_group_name = azurerm_resource_group.vwan-microhack-spoke-rg.name
ip_configuration {
resource "azurerm_bastion_host" "vm" {
count = var.create_bastion ? 1 : 0
name = "GitHubRunners"
location = azurerm_resource_group.vm.location
resource_group_name = azurerm_resource_group.vm.name
resource "azurerm_bastion_host" "bastion_host" {
name = "bastion-host"
resource_group_name = azurerm_resource_group.bastion_rg.name
location = var.location
ip_configuration {
resource "azurerm_bastion_host" "bastion" {
name = var.bastion_host
location = var.location
resource_group_name = azurerm_resource_group.rg.name
ip_configuration {
resource "azurerm_bastion_host" "bastion" {
name = "kubebastion"
location = azurerm_resource_group.kubetest.location
resource_group_name = azurerm_resource_group.kubetest.name
ip_configuration {
resource "azurerm_bastion_host" "bastion" {
name = "bastion"
location = var.location
resource_group_name = data.azurerm_resource_group.management.name
depends_on = [azurerm_virtual_network.management]
resource "azurerm_bastion_host" "bastion_host" {
name = "bastion-host"
resource_group_name = azurerm_resource_group.bastion_rg.name
location = var.location
ip_configuration {
resource "azurerm_bastion_host" "bastion" {
name = "hellobastion"
location = azurerm_resource_group.bastion.location
resource_group_name = azurerm_resource_group.bastion.name
ip_configuration {
resource "azurerm_bastion_host" "bastion" {
name = var.bastion_host_name
location = var.location
resource_group_name = var.resourcegroup_name
ip_configuration {
Parameters
-
dns_name
optional computed - string -
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
ip_configuration
list block-
name
required - string -
public_ip_address_id
required - string -
subnet_id
required - string
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a Bastion Host.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/bastionHosts (Azure Resource Manager)
The bastionHosts in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/bastionHosts
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/bastionHosts"
}
]
}
},
"List_all_Bastion_Hosts_for_a_given_resource_group": {
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"tags": {
"tag1": "value1",
"tag2": "value2"
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
"type": "Microsoft.Network/bastionHosts",
"etag": "w/\\00000000-0000-0000-0000-000000000000\\",
"location": "West US",
"properties": {
"provisioningState": "Succeeded",
"dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
Parameters
name
required - stringThe name of the Bastion Host.
type
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredipConfigurations
optional arrayproperties
optionalsubnet
requiredid
required - stringResource ID.
publicIPAddress
requiredid
required - stringResource ID.
privateIPAllocationMethod
optional - stringPrivate IP allocation method.
name
optional - stringName of the resource that is unique within a resource group. This name can be used to access the resource.
dnsName
optional - stringFQDN for the endpoint on which bastion host is accessible.
Frequently asked questions
What is Azure Network Bastion Host?
Azure Network Bastion Host is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Bastion Host?
For Terraform, the mddazure/azure-vwan-microhack, zipphreak/azure-vwan-microhack2.0 and techcentr/org-github-runners source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the rwth-acis/apis-guru-statistics, debhol/azuredocs and debhol/azuredocs source code examples are useful. See the Azure Resource Manager Example section for further details.