Azure subscriptions should have at least one Azure Bastion host

Prowler check network_bastion_host_exists looks for an Azure Bastion host in the Azure subscription. Azure Bastion brokers RDP/SSH over TLS on 443/TCP to virtual machines using private IPs. The assessment identifies whether such a bastion is available.

Absent Bastion, admins often assign public IPs or open 22/3389, expanding attack surface. This enables Internet brute force, credential stuffing, and RDP/SSH exploits, leading to unauthorized access, data exfiltration, and lateral movement.

What this control checks

Azure Bastion host coverage at the subscription level

Common pitfalls

Bastion needs AzureBastionSubnet with /27

Ensure a subnet named AzureBastionSubnet exists with a /27 address space; create it if prompted.

Audit evidence

Evidence that deployed resources meet this control: Prowler check network_bastion_host_exists (prowler azure --checks network_bastion_host_exists); PowerPipe control azure_compliance.control.network_bastion_host_min_1.

Framework-specific interpretation

ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security), A.8.21 (Security of Network Services) and A.8.22 (Segregation of Networks).

NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 2.3.1 (The relevant entities shall review independently their approach to managing network and information system security and...), 6.7.2.b (determine and apply controls to protect the relevant entities internal network domains from unauthorised access;) and 1 more clause.