A Virtual Machine is a critical part of many cloud projects and
infrastructures. We rely on VMs for applications to run,
users to connect, databases to function, and so much more.
To securely log into AVM and completely avoid the public internet when doing
so, that is what Azure Bastion is for.
Bastion is a fully managed PaaS solution,
you don't have to worry about any infrastructure set up.
To use Bastion you simply log in through the Azure portal,
then use the Bastion service to connect to any of your VMs on the
target Subnet.
This provides full remote desktop access to the VM using TLS
or full SSH access.
You don't have to install any special agent or software on the VMs either.
Bastion just works.
One simple reason really: no public access.
When you use Bastion,
you connect through the Azure portal instead of directly to the VM.
Hence the VM doesn't need a public IP address,
meaning no public access.
And that eliminates about 99% of attacks or well,
thereabouts. Okay.
Let me show you how you can log into your VMs using Azure Bastion.
To connect to a Virtual Machine using Bastion,
you have to set up Bastion in the first place. So let's go to Bastions,
and you can see here I have an ACG Bastion instance. If I go into that,
you can see here that there is a virtual network and subnet. So that's the key.
You have a virtual network, in this case Bastion VNet,
and there's an Azure Bastion subnet.
And that is the subnet that is going to be connected through to any VM that is
on this particular VNet.
So you have to have the same VNet for the Bastion and the Virtual Machines,
but they don't have to be on the same subnet.
If I go back to the Virtual Machines,
so you have a bastionvm1. If I want to connect to that,
there's a connect dropdown here and I can choose IDP, SSH or Bastion.
So if I choose Bastion, it'll go to the connect menu on the settings here,
I can then press use Bastion. And then it'll just go down to the Bastion menu,
if I just scroll down you can see it's under Bastion in operations.
And you can see the provisioning state is succeeded,
which means that Bastion is now accessing this VM once I put
in the username and password.
So if I put in the username and then the password and
I can then connect to it,
you can see that it starts up the renewal desktop session inside the browser.
So I'm now using Bastion through the Azure portal to connect to a Virtual
Machine, which means I'm not accessing over the public internet.
I'm actually using the portal, which is authenticated to me,
and then I'm using Bastion through the portal to connect to the VM.
And I'm now here on the remote desktop of that particular Virtual Machine.
That's just loading up here.
And this is the first time I'm connecting to this server,
which is a Windows server 2019.
And you can see it just starts up like any other network the first time,
and it is a full remote desktop experience.
The only thing currently you can't do is copying files,
but you could use something like OneDrive to get around that and copying files
through OneDrive. But that's it. That is how easy Bastion is to use.
You set up Bastion on that same VNet as your Virtual Machines,
you create a subnet for Bastion,
and then you just choose connect on the Virtual Machine through Bastion,
and it uses that subnet to connect securely through the Azure portal
without going on the public internet. Very clever.
Let's recap the benefits of why you should use Azure Bastion to access
your Virtual Machines.
It protects RDP and SSH ports from the outside world.
It provides secure access using RDP and SSH.
It limits the need for a public IP address.
No special agent or software is needed.
You can confidently say no one from the outside can access the VMs.
While there is a cost to using Bastion, of course,
it is worth weighing that cost up against the peace of mind and management
of access to VMs as well as not having them exposed to the public internet.
If you enjoyed this video, give it a thumbs up, and consider subscribing to the channel
for everything cloud computing. And with that, keep being awesome Cloud Gurus.