Azure Bastion

Managed RDP and SSH jump host reached over TLS without public VM IPs.

Provider: azure
Kind: Bastion host
Category: Security
Official docs: https://learn.microsoft.com/en-us/azure/bastion/bastion-overview

Properties · 5 set by this component

property	type	values	required	kind default	this component
instanceCount · component property	integer	—	no	2	inherited
justInTimeAccess	boolean	—	no	false	▸ false
managed	boolean	—	no	false	▸ true
mfaRequired	boolean	—	no	—	inherited
protocols	enum	ssh \| rdp \| both	no	—	▸ both
publicIp	boolean	—	no	—	▸ true
sessionRecording	boolean	—	no	—	▸ false
shareableLink · component property	boolean	—	no	false	inherited
sku · component property	enum	developer \| basic \| standard \| premium	no	—	inherited

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "bastion", component: "azure-bastion" }

Other Bastion host products · 17

Bastionhostalibaba-bastionhostalibabacloudbastion-host EC2 Instance Connect Endpointaws-ec2-instance-connect-endpointawsbastion-host AWS Systems Manager Session Manageraws-ssm-session-managerawsbastion-host AWS Verified Accessaws-verified-accessawsbastion-host Microsoft Entra Private Accessazure-entra-private-accessazurebastion-host Cloudflare Accesscloudflare-accesscloudflarebastion-host Cloudflare One RDPcloudflare-rdpcloudflarebastion-host Generic bastion hostbastion-hostbastion-host HashiCorp Boundaryboundarybastion-host ContainerSSHcontainersshbastion-host Paralusparalusbastion-host Pomeriumpomeriumbastion-host OpenSSH jump hostssh-jump-hostbastion-host Teleportteleportbastion-host Chrome Enterprise Premiumgoogle-chrome-enterprise-premiumgcpbastion-host Identity-Aware Proxygoogle-identity-aware-proxygcpbastion-host Bastionoci-bastionocibastion-host

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Azure Bastion: managed RDP/SSH jump host reached over TLS on port 443 ("What is Azure Bastion?").
3# Basic, Standard and Premium deploy into AzureBastionSubnet with a public IP and two instances;
4# session recording and private-only deployment are Premium-only, so both are off out of the box.
5schemaVersion: "1"
6type: "component"
7id: "azure-bastion"
8kind: "bastion-host"
9provider: "azure"
10docs: "https://learn.microsoft.com/en-us/azure/bastion/bastion-overview"
11defaults:
12  managed: true
13  protocols: "both"
14  publicIp: true
15  sessionRecording: false
16  justInTimeAccess: false
17properties:
18  sku:
19    type: "enum"
20    values: ["developer", "basic", "standard", "premium"]
21  instanceCount:
22    type: "integer"
23    default: 2
24  shareableLink:
25    type: "boolean"
26    default: false

The same page as markdown, for an agent: /catalogue/components/azure-bastion.md