Detections
Analytics

8.1 Ensure an Azure Bastion Host Exists

Information

The Azure Bastion service allows secure remote access to Azure Virtual Machines over the Internet without exposing remote access protocol ports and services directly to the Internet. The Azure Bastion service provides this access using TLS over 443/TCP, and subscribes to hardened configurations within an organization's Azure Active Directory service.

Rationale:

The Azure Bastion service allows organizations a more secure means of accessing Azure Virtual Machines over the Internet without assigning public IP addresses to those Virtual Machines. The Azure Bastion service provides Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to Virtual Machines using TLS within a web browser, thus preventing organizations from opening up 3389/TCP and 22/TCP to the Internet on Azure Virtual Machines. Additional benefits of the Bastion service includes Multi-Factor Authentication, Conditional Access Policies, and any other hardening measures configured within Azure Active Directory using a central point of access.

Impact:

The Azure Bastion service incurs additional costs and requires a specific virtual network configuration. The Standard tier offers additional configuration options compared to the Basic tier and may incur additional costs for those added features.

Solution

Remediate from Azure Portal

Click on Bastions

Select the Subscription

Select the Resource group

Type a Name for the new Bastion host

Select a Region

Choose Standard next to Tier

Use the slider to set the Instance count

Select the Virtual network or Create new

Select the Subnet named AzureBastionSubnet. Create a Subnet named AzureBastionSubnet using a /26 CIDR range if it doesn't already exist.

Selct the appropriate Public IP address option.

If Create new is selected for the Public IP address option, provide a Public IP address name.

If Use existing is selected for Public IP address option, select an IP address from Choose public IP address

Click Next: Tags >

Configure the appropriate Tags

Click Next: Advanced >

Select the appropriate Advanced options

Click Next: Review + create >

Click Create

Remediate from Azure CLI

az network bastion create --location <location> --name <name of bastion host> --public-ip-address <public IP address name or ID> --resource-group <resource group name or ID> --vnet-name <virtual network containing subnet called 'AzureBastionSubnet'> --scale-units <integer> --sku Standard [--disable-copy-paste true|false] [--enable-ip-connect true|false] [--enable-tunneling true|false]

Remediate from PowerShell
Create the appropriate Virtual network settings and Public IP Address settings.

$subnetName = 'AzureBastionSubnet'
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix <IP address range in CIDR notation making sure to use a /26>
$virtualNet = New-AzVirtualNetwork -Name <virtual network name> -ResourceGroupName <resource group name> -Location <location> -AddressPrefix <IP address range in CIDR notation> -Subnet $subnet
$publicip = New-AzPublicIpAddress -ResourceGroupName <resource group name> -Name <public IP address name> -Location <location> -AllocationMethod Dynamic -Sku Standard

Create the Azure Bastion service using the information within the created variables from above.

New-AzBastion -ResourceGroupName <resource group name> -Name <bastion name> -PublicIpAddress $publicip -VirtualNetwork $virtualNet -Sku 'Standard' -ScaleUnit <integer>

Default Value:

By default, the Azure Bastion service is not configured.

See Also

https://workbench.cisecurity.org/benchmarks/16820

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|CM-8, 800-53|CM-8(1), 800-53|SC-7, CSCv7|9.2, CSCv7|11.2, CSCv7|12.1

Plugin: microsoft_azure

Control ID: 6418c175ec276e9e62dbd0474102ad6614c8443e6dca41c5fc37d873dc8f7173