Just a quick post to highlight an undocumented requirement for Azure Bastion that I came across when deploying a Landing Zone.
I’m creating a new landing zone for a client and we’re using Azure Bastion for secure access to IaaS VM’s. I decided to create the resource in a separate resource group than the Virtual Network as it was uncertain whether this was going to be required long term or not. There’s nothing in the current documentation that indicates that it isn’t possible, so I tried to deploy.
After a few minutes, it failed:
Here’s the less than helpful error:
No matter what I tried (Portal, Terraform, Azure CLI), the same occurred.
Upon speaking to Azure Support, this is a known issue and the mitigation is to deploy the Bastion host within the same Resource Group as the Virtual Network that it is trying to connect to.
I’ve experienced the same when deploying API Management in Azure, but at least the errors from ARM are meaningful and pointed me in the right direction.
Hopefully if you come across the same, and the problem isn’t resolved, this will help you out.