Control: 8.4.1 Ensure an Azure Bastion Host Exists

Description

The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.

Remediation

Remediate from Azure Portal

Click on Bastions.
Select the Subscription.
Select the Resource group.
Type a Name for the new Bastion host.
Select a Region.
Choose Standard next to Tier.
Use the slider to set the Instance count.
Select the Virtual network or Create new.
Select the Subnet named AzureBastionSubnet. Create a Subnet named AzureBastionSubnet using a /26 CIDR range if it doesn't already exist.
Select the appropriate Public IP address option.
If Create new is selected for the Public IP address option, provide a Public IP address name.
If Use existing is selected for Public IP address option, select an IP address from Choose public IP address.
Click Next: Tags >.
Configure the appropriate Tags.
Click Next: Advanced >.
Select the appropriate Advanced options.
Click Next: Review + create >.
Click Create.

Remediate from Azure CLI

az network bastion create --location <location> --name <name of bastion host>
--public-ip-address <public IP address name or ID> --resource-group <resource
group name or ID> --vnet-name <virtual network containing subnet called
"AzureBastionSubnet"> --scale-units <integer> --sku Standard [--disable-copypaste true|false] [--enable-ip-connect true|false] [--enable-tunneling
true|false]

Remediate from PowerShell

Create the appropriate Virtual network settings and Public IP Address settings.

$subnetName = "AzureBastionSubnet"
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix
<IP address range in CIDR notation making sure to use a /26>
$virtualNet = New-AzVirtualNetwork -Name <virtual network name> -
ResourceGroupName <resource group name> -Location <location> -AddressPrefix
<IP address range in CIDR notation> -Subnet $subnet
$publicip = New-AzPublicIpAddress -ResourceGroupName <resource group name> -
Name <public IP address name> -Location <location> -AllocationMethod Dynamic
-Sku Standard

Create the Azure Bastion service using the information within the created variables from above.

New-AzBastion -ResourceGroupName <resource group name> -Name <bastion name> -
PublicIpAddress $publicip -VirtualNetwork $virtualNet -Sku "Standard" -
ScaleUnit <integer>

Default Value

By default, the Azure Bastion service is not configured.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_8_4_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_8_4_1 --share

SQL

This control uses a named query:

with bastion_hosts as (
  select
    subscription_id,
    _ctx,
    region,
    resource_group,
    count(*) as no_bastion_host
  from
    azure_bastion_host
  group by
    subscription_id,
    _ctx,
    resource_group,
    region
)
select
  sub.id as resource,
  case
    when i.subscription_id is null then 'alarm'
    else 'ok'
  end as status,
  case
    when i.subscription_id is null then sub.display_name || ' does not have bastion host.'
    else sub.display_name || ' has ' || no_bastion_host || ' bastion host(s).'
  end as reason
  , i.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_subscription as sub
  left join bastion_hosts as i on i.subscription_id = sub.subscription_id;