IaC Bazaar
AzureLive-tested

Azure Bastion + Hardened Jumpbox

Bastion (Developer/Basic/Standard SKU) with optional hardened Linux VM, JIT-style NSG rules and boot diagnostics for secure VM access without public IPs.

terraformAzure#azure
azure-bastion-jumpboxterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-29 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o azure-bastion-jumpbox-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/azure-bastion-jumpbox/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle azure-bastion-jumpbox-1.0.0.sigstore.json \
  azure-bastion-jumpbox-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "57a33ac925a4d6b26707ed14e7000b12d708c11be1db25b5f83b99cb96c67a7d  azure-bastion-jumpbox-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "bastion_jumpbox" {
  source  = "www.iac-bazaar.com/iac-bazaar/azure-bastion-jumpbox/azure"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Basic, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

azure-bastion-jumpbox

Status: static-validated, live-test pending. Ships under live-test quarantine — provisioning a Bastion needs a real VNet with an AzureBastionSubnet (>= /26) and a jumpbox image pull, and the Trusted Launch / encryption-at-host features must be registered on the subscription, none of which exist in a CI sandbox yet. The full apply → verify → destroy gate runs once an Azure sandbox subscription is wired up. Schema is validated against the azurerm v4 provider docs (built against 4.76).

Secure VM access without public IPs: an Azure Bastion host (Developer / Basic / Standard) plus an optional hardened Linux jumpbox reachable only through the Bastion. Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.

The Developer SKU is the free-tier-friendly option for short-lived tests (it references the VNet directly and provisions no dedicated public IP or subnet); Basic/Standard attach to an AzureBastionSubnet with a Standard public IP, and Standard unlocks native-client tunneling, IP-connect and file-copy.

Secure defaults

  • Jumpbox has no public IP — it is reachable only by going through Bastion.
  • SSH-key auth only; password authentication is disabled (a precondition requires jumpbox_ssh_public_key).
  • Trusted Launch: Secure Boot + vTPM on, plus encryption at host.
  • Deny-by-default NSG on the jumpbox NIC: an explicit catch-all denies all inbound, and a single allow rule permits SSH from jumpbox_allowed_ssh_source_address. This defaults to the VirtualNetwork tag — the whole VNet (which contains Bastion, but also any other VM/workload in the VNet). For strict Bastion-only SSH, set it to the AzureBastionSubnet CIDR (see Requirements & notes).
  • System-assigned managed identity on the jumpbox for least-privilege role grants; boot diagnostics on a managed storage account by default.
  • Bastion public IP is Standard / static / zone-deployable.

License

Commercial — LicenseRef-IaCBazaar-Commercial

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs
  • Requirements & notes

Related modules

Azure✓ live-tested

Entra ID Workload Identity Baseline

App registrations, service principals, groups and federated credentials (OIDC for GitHub/Terraform) - the identity plumbing every Azure org rebuilds by hand.

$29.00v1.0.0
Azure✓ live-tested

User-Assigned Managed Identities

A map-driven module creating one or many user-assigned managed identities, each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments - no secrets to rotate.

$29.00v1.0.0