Repository files navigation

Azure Virtual Machine (VM) with Just-in-Time access.

You'll need to enableMicrosoft Defender for Servers for the Subscription.

Make sure you enableCloud Workload Protection (CWP) forServers. After that, install the agents using the Portal just for completeness.

Create the.auto.tfvars file and set the required parameters:

cp config/template.tfvars .auto.tfvars

Create the temporary keys:

mkdir .keys&& ssh-keygen -f .keys/temp_rsa

Start by creating the sandbox infrastructure:

terraform initterraform apply -auto-approve

If everything goes right, the JIT policy will automatically be created to the VM by the TerraformAzApi provider.

Permissions required are:

• Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action
• Microsoft.Compute/virtualMachines/read

To be able to login with Entra ID credentials, users must have one of:

• Virtual Machine Administrator Login
• Virtual Machine User Login

Defender should have created the followingDeny rule:

Now request your JIT access.

Defender should create the followingAllow rule:

It is possible to extend VM management capabilities using theVMAccess extension.

To install the extension using Terraform:

# VMAccessinstall_vmaccess_extension =true

To check for deployed extensions and the installation status:

az vm extension list \    --resource-group<resource-group> \    --vm-name<vm-name> -o table

Don't forget to disable Microsoft Defender if you're only testing.

Destroy the infrastructure:

terraform destroy -auto-approve