bcgov/Deploy VM + Bastion (ALZ)
Deploy an Azure Bastion + Linux jumpbox into the BC Gov Azure Landing Zone using the bundled Terraform. Run this as a step inside a job that sets `environment:` (for OIDC + environment-scoped secrets) and grants `id-token: write`.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 13, 2026
- License
- Apache 2.0
Pinned Snippet
uses: bcgov/action-deployer-vm-bastion-alz@97815793db79d6e0c5b95f5f43d2618173ea1f36 # v1.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| app_name | Application name. Used for resource naming and the Terraform state key. | yes | — |
| app_env | Application environment (e.g. tools, dev, test, prod). | yes | — |
| terraform_command | Terraform operation to run: apply, plan, or destroy. | no | apply |
| tfvars_file | Path (relative to the caller's checked-out workspace) to a .tfvars file. Staged as terraform.tfvars. | no | "" |
| location | Azure region. Overrides tfvars when set. | no | Canada Central |
| resource_group_name | Resource group name. Defaults to <app_name>-<app_env> when empty. | no | "" |
| vm_size | Jumpbox VM size. Overrides tfvars when set. | no | "" |
| os_disk_size_gb | Jumpbox OS disk size in GB. Overrides tfvars when set. | no | "" |
| bastion_sku | Azure Bastion SKU (Standard or Premium). Overrides tfvars when set. | no | "" |
| enable_bastion | Deploy Azure Bastion (true/false). Overrides tfvars when set. | no | "" |
| enable_jumpbox | Deploy the jumpbox VM (true/false). Overrides tfvars when set. | no | "" |
| enable_bastion_automation | Enable Bastion delete/recreate automation runbooks (true/false). Overrides tfvars when set. | no | "" |
| enable_monitoring | Create/attach a Log Analytics Workspace and enable Bastion audit diagnostics (true/false). Set false to skip the workspace entirely. Overrides tfvars when set. | no | "" |
| existing_log_analytics_workspace_id | Resource ID of an existing Log Analytics Workspace (BYO LAW). When set, no workspace is created. Overrides tfvars when set. | no | "" |
| backend_storage_account | Storage account name holding Terraform state. Pass STORAGE_ACCOUNT_NAME (set by initial-azure-setup.sh). | yes | — |
| backend_resource_group | Resource group of the state storage account. Defaults to vnet_resource_group_name when empty. | no | "" |
| backend_container_name | Blob container for Terraform state. | no | tfstate |
| backend_state_key | State blob key. Defaults to <app_name>/<app_env>/terraform.tfstate when empty. | no | "" |
| azure_client_id | Azure AD app (OIDC) client ID. | yes | — |
| azure_tenant_id | Azure AD tenant ID. | yes | — |
| azure_subscription_id | Target Azure subscription ID. | yes | — |
| vnet_name | Existing spoke VNet name (from the platform team). | yes | — |
| vnet_resource_group_name | Resource group of the existing VNet. | yes | — |
| vnet_address_space | Address space of the existing VNet (e.g. 10.46.115.0/24). | yes | — |
| bastion_subnet_address_prefix | CIDR for the AzureBastionSubnet. Must be /26 or larger (e.g. 10.46.115.64/26). Pass from a secret to keep IP ranges out of logs. | yes | — |
| jumpbox_subnet_address_prefix | CIDR for the jumpbox subnet (e.g. 10.46.115.128/28). Pass from a secret to keep IP ranges out of logs. | yes | — |
| vm_admin_login_principal_ids | Comma-separated Entra object IDs (users and/or groups) granted Virtual Machine Administrator Login on the jumpbox. Required: with none, nobody can Entra-SSH in. Use object IDs (GUIDs), not UPNs / emails / display names. | yes | — |
Outputs
no outputs