Functions/Request-AHJITVMAccess.ps1

Function Request-AHJITVMAccess {
    [CmdletBinding()]
    param (
        [Parameter()]
        [string]
        $Id,
        # [Parameter()]
        # [int[]]
        # $Ports,
        [Parameter()]
        [int]
        [ValidateScript( { $_ -le 24 })]
        $Hours = 4,
        [Parameter()]
        [validateScript( { [IPAddress] $_ })]
        [string]
        $SourceIP = $(Get-AHMyPublicIPAddress),
        [Parameter()]
        [ValidateSet("Linux", "Windows")]
        [string]
        $OS
    )

    $MyResource = Get-AzResource -ResourceId $Id
    If (!$?) {
        throw "Invalid ResourceId"
    }

    # Start Section: Put policy in place
    <#
    $JitPolicy = (@{
            id = $Id;
            ports = (@{
                    number = 22;
                    protocol = "*";
                    allowedSourceAddressPrefix = @($(Get-AHMyPublicIPAddress)); #@("*");
                    maxRequestAccessDuration = "PT3H"
                },
                @{
                    number = 3389;
                    protocol = "*";
                    allowedSourceAddressPrefix = @($(Get-AHMyPublicIPAddress)); #@("*");
                    maxRequestAccessDuration = "PT3H"
                })
        })
    $AssignmentVM = @($JitPolicy)
    Set-AzJitNetworkAccessPolicy -Kind "Basic" -Location $MyResource.Location -Name "default" -ResourceGroupName $MyResource.ResourceGroupName -VirtualMachine $AssignmentVM
    #>

    # End Section: Put policy in place

    #Start Section: Activate Policy
    $JitPolicyVm1 = (@{
            id    = $Id; 
            ports = (@{
                    number                     = If ('Windows' -eq $OS) { 3389 }elseif ('Linux' -eq $OS) { 22 }else { throw "invalid OS" };
                    endTimeUtc                 = get-date (Get-Date -AsUTC).AddHours($Hours) -Format O  #"12/09/2020 20:11:18";
                    allowedSourceAddressPrefix = @($(Get-AHMyPublicIPAddress)) #@("173.72.158.65")
                })
        })
    $ActivationVM = @($JitPolicyVm1)

    Start-AzJitNetworkAccessPolicy -ResourceGroupName $MyResource.ResourceGroupName -Location $MyResource.Location -Name "default" -VirtualMachine $ActivationVM
    #End Section: Activate Policy


}
<#
$testOut = Request-AHJITVMAccess `
    -Id /subscriptions/c85c1e96-a251-49cd-8b78-050291feeea1/resourceGroups/PolicyDemo/providers/Microsoft.Compute/virtualMachines/PolicyDemoVM1 `
    -Hours 1 `
    -OS Linux



$MyPublicIP = Get-AHMyPublicIPAddress
$MyResource = Get-AzResource -Id /subscriptions/c85c1e96-a251-49cd-8b78-050291feeea1/resourceGroups/PolicyDemo/providers/Microsoft.Compute/virtualMachines/PolicyDemoVM1
$JitPolicy = (@{
        id = $MyResource.ResourceId;
        ports = (@{
                number = 22
                endTimeUtc = Get-Date (Get-Date -AsUTC).AddHours(1) -Format O
                allowedSourceAddressPrefix = @($MyPublicIP)
            })
    })
$ActivationVM = @($JitPolicy)
Start-AzJitNetworkAccessPolicy -ResourceGroupName $($MyResource.ResourceGroupName) -Location $MyResource.Location -Name "default" -VirtualMachine $ActivationVM







#>




<#
https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time?tabs=jit-config-powershell%2Cjit-request-powershell#enable-jit-vm-access-
https://docs.microsoft.com/en-us/powershell/module/az.security/start-azjitnetworkaccesspolicy?view=azps-5.2.0
https://docs.microsoft.com/en-us/powershell/module/az.security/set-azjitnetworkaccesspolicy?view=azps-5.2.0
#>