Bastion Host Does Not Exist

Overview

The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.

The Azure Bastion service allows organizations a more secure means of accessing Azure Virtual Machines over the Internet without assigning public IP addresses to those Virtual Machines. The Azure Bastion service provides Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to Virtual Machines using TLS within a web browser, thus preventing organizations from opening up 3389/TCP and 22/TCP to the Internet on Azure Virtual Machines. Additional benefits of the Bastion service includes Multi-Factor Authentication, Conditional Access Policies, and any other hardening measures configured within Azure Active Directory using a central point of access.

The Azure Bastion service incurs additional costs and requires a specific virtual network configuration. The Standard tier offers additional configuration options compared to the Basic tier and may incur additional costs for those added features.

Vendor

Azure

Cloud Service

Network Manager

Related Controls

CIS Azure v2.0.0 7.1

References

https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku, https://learn.microsoft.com/en-us/powershell/module/az.network/get-azbastion?view=azps-9.2.0, https://learn.microsoft.com/en-us/cli/azure/network/bastion?view=azure-cli-latest

Severity

3

Item Types

Custom::Microsoft::Subscription