output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/eslzArm/subscriptionTemplates/bastion.json
|
{ "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vnetName": { "type": "string", "defaultValue": "vnet01", "metadata": { "description": "Name of new or existing vnet to which Azure Bastion should be deployed" } }, "vnetIpPrefix": { "type": "string", "defaultValue": "10.100.0.0/16", "metadata": { "description": "IP prefix for available addresses in vnet address space" } }, "vnetNewOrExisting": { "type": "string", "defaultValue": "existing", "allowedValues": [ "new", "existing" ], "metadata": { "description": "Specify whether to provision new vnet or deploy to existing vnet" } }, "bastionSubnetIpPrefix": { "type": "string", "defaultValue": "10.100.3.0/26", "metadata": { "description": "Bastion subnet IP prefix MUST be within vnet IP prefix address space" } }, "bastionHostName": { "type": "string", "metadata": { "description": "Name of Azure Bastion resource" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Azure region for Bastion and virtual network" } }, "topLevelManagementGroupPrefix": { "type": "string", "metadata": { "description": "Name of the intermediate root management group" } }, "resourceGroupOverride": { "type": "string", "defaultValue": "", "metadata": { "description": "Name of the resource group to deploy to" } }, "bastionSku": { "type": "string", "defaultValue": "Premium", "allowedValues": [ "Basic", "Developer", "Standard", "Premium" ], "metadata": { "description": "The SKU of the Bastion Host to deploy" } } }, "variables": { "resourceDeploymentName": "[format('{0}-deployment', parameters('bastionHostName'))]", "rgName": "[if(empty(parameters('resourceGroupOverride')), concat('rg-', parameters('topLevelManagementGroupPrefix'), '-vnethub-', parameters('location')), parameters('resourceGroupOverride'))]" }, "resources": [ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", "name": "[variables('resourceDeploymentName')]", "resourceGroup": "[variables('rgName')]", "dependsOn": [], "properties": { "mode": "Incremental", "expressionEvaluationOptions": { "scope": "inner" }, "parameters": { "location": { "value": "[parameters('location')]" }, "vnetName": { "value": "[parameters('vnetName')]" }, "vnetIpPrefix": { "value": "[parameters('vnetIpPrefix')]" }, "vnetNewOrExisting": { "value": "[parameters('vnetNewOrExisting')]" }, "bastionSubnetIpPrefix": { "value": "[parameters('bastionSubnetIpPrefix')]" }, "bastionHostName": { "value": "[parameters('bastionHostName')]" }, "bastionSku": { "value": "[parameters('bastionSku')]" } }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "location": { "type": "string" }, "vnetName": { "type": "string" }, "vnetIpPrefix": { "type": "string" }, "vnetNewOrExisting": { "type": "string" }, "bastionSubnetIpPrefix": { "type": "string" }, "bastionHostName": { "type": "string" }, "bastionSku": { "type": "string" } }, "variables": { "publicIpAddressName": "[format('{0}-pip', parameters('bastionHostName'))]", "bastionSubnetName": "AzureBastionSubnet", "nsgName": "[format('{0}-nsg', parameters('bastionHostName'))]" }, "resources": [ { "type": "Microsoft.Network/publicIPAddresses", "apiVersion": "2024-05-01", "name": "[variables('publicIpAddressName')]", "location": "[parameters('location')]", "sku": { "name": "Standard" }, "zones": [ "1", "2", "3" ], "properties": { "publicIPAllocationMethod": "Static" } }, { "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2022-07-01", "name": "[variables('nsgName')]", "location": "[parameters('location')]", "properties": { "securityRules": [ { "name": "AllowHttpsInBound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "Internet", "destinationPortRange": "443", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" } }, { "name": "AllowGatewayManagerInBound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "GatewayManager", "destinationPortRange": "443", "destinationAddressPrefix": "*", "access": "Allow", "priority": 110, "direction": "Inbound" } }, { "name": "AllowLoadBalancerInBound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "AzureLoadBalancer", "destinationPortRange": "443", "destinationAddressPrefix": "*", "access": "Allow", "priority": 120, "direction": "Inbound" } }, { "name": "AllowBastionHostCommunicationInBound", "properties": { "protocol": "*", "sourcePortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationPortRanges": [ "8080", "5701" ], "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 130, "direction": "Inbound" } }, { "name": "DenyAllInBound", "properties": { "protocol": "*", "sourcePortRange": "*", "sourceAddressPrefix": "*", "destinationPortRange": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 1000, "direction": "Inbound" } }, { "name": "AllowSshRdpOutBound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "*", "destinationPortRanges": [ "22", "3389" ], "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 100, "direction": "Outbound" } }, { "name": "AllowAzureCloudCommunicationOutBound", "properties": { "protocol": "Tcp", "sourcePortRange": "*", "sourceAddressPrefix": "*", "destinationPortRange": "443", "destinationAddressPrefix": "AzureCloud", "access": "Allow", "priority": 110, "direction": "Outbound" } }, { "name": "AllowBastionHostCommunicationOutBound", "properties": { "protocol": "*", "sourcePortRange": "*", "sourceAddressPrefix": "VirtualNetwork", "destinationPortRanges": [ "8080", "5701" ], "destinationAddressPrefix": "VirtualNetwork", "access": "Allow", "priority": 120, "direction": "Outbound" } }, { "name": "AllowGetSessionInformationOutBound", "properties": { "protocol": "*", "sourcePortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "Internet", "destinationPortRanges": [ "80", "443" ], "access": "Allow", "priority": 130, "direction": "Outbound" } }, { "name": "DenyAllOutBound", "properties": { "protocol": "*", "sourcePortRange": "*", "destinationPortRange": "*", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 1000, "direction": "Outbound" } } ] } }, { "condition": "[equals(parameters('vnetNewOrExisting'), 'new')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2022-07-01", "name": "[parameters('vnetName')]", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('vnetIpPrefix')]" ] }, "subnets": [ { "name": "[variables('bastionSubnetName')]", "properties": { "addressPrefix": "[parameters('bastionSubnetIpPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]" } } } ] }, "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]" ] }, { "condition": "[equals(parameters('vnetNewOrExisting'), 'existing')]", "type": "Microsoft.Network/virtualNetworks/subnets", "apiVersion": "2022-07-01", "name": "[format('{0}/{1}', parameters('vnetName'), variables('bastionSubnetName'))]", "properties": { "addressPrefix": "[parameters('bastionSubnetIpPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]" } }, "dependsOn": [ "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]" ] }, { "type": "Microsoft.Network/bastionHosts", "apiVersion": "2024-05-01", "name": "[parameters('bastionHostName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('bastionSku')]" }, "zones": [ "1", "2", "3" ], "properties": { "ipConfigurations": [ { "name": "IpConf", "properties": { "subnet": { "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), variables('bastionSubnetName'))]" }, "publicIPAddress": { "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIpAddressName'))]" } } } ] }, "dependsOn": [ "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]", "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIpAddressName'))]", "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), variables('bastionSubnetName'))]" ] } ] } } } ] } |