Control: Ensure an Azure Bastion Host exists

Description

The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.network_bastion_host_min_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.network_bastion_host_min_1 --share

SQL

This control uses a named query:

with bastion_hosts as (
  select
    subscription_id,
    _ctx,
    region,
    resource_group,
    count(*) as no_bastion_host
  from
    azure_bastion_host
  group by
    subscription_id,
    _ctx,
    resource_group,
    region
)
select
  sub.id as resource,
  case
    when i.subscription_id is null then 'alarm'
    else 'ok'
  end as status,
  case
    when i.subscription_id is null then sub.display_name || ' does not have bastion host.'
    else sub.display_name || ' has ' || no_bastion_host || ' bastion host(s).'
  end as reason
  , i.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_subscription as sub
  left join bastion_hosts as i on i.subscription_id = sub.subscription_id;

Control: Ensure an Azure Bastion Host exists

Description

Usage

SQL

Tags