Azure Compliance ControlsAzure Bastion
Azure subscriptions should have at least one Azure Bastion host
Prowler check network_bastion_host_exists looks for an Azure Bastion host in the Azure subscription. Azure Bastion brokers RDP/SSH over TLS on 443/TCP to virtual machines using private IPs. The assessment identifies whether such a bastion is available.
What this control checks
Azure Bastion host coverage at the subscription level
Framework mappings
The clauses this control is mapped to in each framework.
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 9.4.1 Ensure an Azure Bastion Host Exists
- 8.4.1 Ensure an Azure Bastion Host Exists
RBI Cyber Security Framework for UCBs
- Annex I (5.1)
- Annex I (7.3)
- 7.1 Ensure an Azure Bastion Host Exists
- 7.1 Ensure an Azure Bastion Host Exists
- 8.1 Ensure an Azure Bastion Host Exists
Related controls
- Network security groups should limit inbound TCP port 3306 access from the internet
- Regions with newly created virtual networks should have Network Watcher deployed
- Virtual machine network interfaces should have IP forwarding disabled
- Azure SQL databases should have public network access disabled
- Container registries should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_bastion_host_min_1 - Powerpipe Control:
azure_compliance.control.network_bastion_host_min_1 - Prowler Check:
network_bastion_host_exists
Last reviewed: 2026-10-13