AzureのBastionでパブリックIPなしにLinux VMへSSH接続する方法｜踏み台サーバー不要のセキュア接続手順

この記事のポイント

・Azure BastionでVMのパブリックIPを0件にしてSSH接続できる
・AzureBastionSubnetは/26以上（64アドレス以上）のCIDRが必須
・az network bastion sshはStandardティア以上で利用可能
・NSGはBastionサブネット向けに443・8080ポートの許可が必要

# リソースグループを作成
az group create \
  --name rg-bastion-demo \
  --location japaneast

# VNetとデフォルトサブネットを作成
az network vnet create \
  --resource-group rg-bastion-demo \
  --name myVNet \
  --address-prefix 10.0.0.0/16 \
  --subnet-name default \
  --subnet-prefix 10.0.0.0/24

az network vnet subnet create \
  --resource-group rg-bastion-demo \
  --vnet-name myVNet \
  --name AzureBastionSubnet \
  --address-prefix 10.0.1.0/26

{
  "addressPrefix": "10.0.1.0/26",
  "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-bastion-demo/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/AzureBastionSubnet",
  "name": "AzureBastionSubnet",
  "provisioningState": "Succeeded"
}

az network public-ip create \
  --resource-group rg-bastion-demo \
  --name myBastionPublicIP \
  --sku Standard \
  --allocation-method Static \
  --location japaneast

az network bastion create \
  --resource-group rg-bastion-demo \
  --name myBastion \
  --vnet-name myVNet \
  --public-ip-address myBastionPublicIP \
  --sku Standard \
  --location japaneast

{
  "dnsName": "bst-xxxxxxxx-xxxx.japaneast.bastion.azure.com",
  "name": "myBastion",
  "provisioningState": "Succeeded",
  "sku": { "name": "Standard" }
}

az vm create \
  --resource-group rg-bastion-demo \
  --name myLinuxVM \
  --image RedHat:RHEL:9-lvm-gen2:latest \
  --size Standard_B2s \
  --vnet-name myVNet \
  --subnet default \
  --public-ip-address "" \
  --admin-username azureuser \
  --generate-ssh-keys
# az vm show --resource-group rg-bastion-demo --name myLinuxVM --show-details

az vm show \
  --resource-group rg-bastion-demo \
  --name myLinuxVM \
  --show-details \
  --query "{privateIP:privateIps,publicIP:publicIps}" \
  -o table

PrivateIP    PublicIP
-----------  ----------
10.0.0.4     None

VM_ID=$(az vm show \
  --resource-group rg-bastion-demo \
  --name myLinuxVM \
  --query id \
  -o tsv)

echo $VM_ID
# /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-bastion-demo/providers/Microsoft.Compute/virtualMachines/myLinuxVM

az network bastion ssh \
  --resource-group rg-bastion-demo \
  --name myBastion \
  --target-resource-id $VM_ID \
  --auth-type ssh-key \
  --username azureuser \
  --ssh-key ~/.ssh/id_rsa

Authenticated to myLinuxVM via Bastion.
[azureuser@myLinuxVM ~]$ hostname
myLinuxVM
[azureuser@myLinuxVM ~]$ ip addr show eth0 | grep "inet "
    inet 10.0.0.4/24 brd 10.0.0.255 scope global eth0
[azureuser@myLinuxVM ~]$

The command requires the extension azure-bastion. Do you want to install it now? (Y/n):

az extension add --name bastion

# サブネット名を確認する
az network vnet subnet list \
  --resource-group rg-bastion-demo \
  --vnet-name myVNet \
  --query "[].name" \
  -o table

Result
---------------------
AzureBastionSubnet
default

(BastionOperationNotSupported) Bastion host 'myBastion' doesn't support native client.