Skip to content
This repository has been archived by the owner on Jun 22, 2021. It is now read-only.

Terraform module to create fully platform-managed Azure bastion PaaS service.

License

Notifications You must be signed in to change notification settings

tietoevry-infra-as-code/terraform-azurerm-azure-bastion

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

This repository is no longer maintained actively. Please visit https://github.com/kumarvna?tab=repositories for the latest updates.

Azure Bastion Service Terraform module

The Azure Bastion service is a fully platform-managed PaaS service that provision inside the virtual network. It provides secure and seamless RDP/SSH connectivity to the virtual machines directly in the Azure portal over TLS. When connecting via Azure Bastion, the virtual machines do not need a public IP address.

Azure Bastion deployment is per virtual network, not per subscription/account or virtual machine. Once provisioned an Azure Bastion service in the virtual network, the RDP/SSH experience is available to all the VMs in the same virtual network.

Module Usage

module "azure-bastion" {
  source  = "kumarvna/azure-bastion/azurerm"
  version = "1.0.0"

  # Resource Group, location, VNet and Subnet details
  resource_group_name  = "rg-shared-westeurope-01"
  virtual_network_name = "vnet-shared-hub-westeurope-001"

  # Azure bastion server requireemnts
  azure_bastion_service_name          = "mybastion-service"
  azure_bastion_subnet_address_prefix = ["10.5.0.0/26"]

  # Adding TAG's to your Azure resources (Required)
  tags = {
    ProjectName  = "demo-internal"
    Env          = "dev"
    Owner        = "user@example.com"
    BusinessUnit = "CORP"
    ServiceClass = "Gold"
  }
}

Pre-requisites

Virtual network

You can create a new virtual network in the portal during this process, or use an existing virtual network to create Azure bastion service. If you are using an existing virtual network, make sure the existing virtual network has enough free address space to accommodate the Bastion subnet requirements.

Subnet

The subnet will be dedicated to the Bastion host and must be named as AzureBastionSubnet. This subnet must be at least /27 or larger. User-defined routing (UDR) is not supported on an Azure Bastion subnet. For scenarios that include both Azure Bastion and Azure Firewall/Network Virtual Appliance (NVA) in the same virtual network, you don’t need to force traffic from an Azure Bastion subnet to Azure Firewall because the communication between Azure Bastion and your VMs is private.

Public IP address

The public IP of the Bastion resource on which RDP/SSH will be accessed (over port 443). Create a new public IP, or use an existing one. The public IP address must be in the same region as the Bastion resource you are creating. Public IP address SKU by default to Standard and Azure Bastion uses/supports only the Standard Public IP SKU with a static assignment.

Requirements

Name Version
terraform >= 0.13
azurerm ~> 2.27

Providers

Name Version
azurerm 2.27.0

Inputs

Name Description Type Default
resource_group_name The name of the resource group in which resources are created string ""
virtual_network_name The name of the virtual network string ""
public_ip_allocation_method Defines the allocation method for this IP address. Possible values are Static or Dynamic static "Static"
public_ip_sku The SKU of the Public IP. Accepted values are Basic and Standard string "Standard"
domain_name_label Label for the Domain Name. Will be used to make up the FQDN. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system string null
azure_bastion_service_name Specifies the name of the Bastion Host string ""
azure_bastion_subnet_address_prefix The address prefix to use for the Azure Bastion subnet list []
tags A map of tags to add to all resources map(string) {}

Outputs

Name Description
azure_bastion_subnet_id The resource ID of Azure bastion subnet
azure_bastion_public_ip The public IP of the virtual network gateway
azure_bastion_public_ip_fqdn Fully qualified domain name of the virtual network gateway
azure_bastion_host_id The resource ID of the Bastion Host
azure_bastion_host_fqdn The FQDN of the Bastion Host

Resource Graph

Resource Graph

Authors

Originally created by Kumaraswamy Vithanala

Other resources