bcgov/Deploy VM + Bastion (ALZ)

Deploy an Azure Bastion + Linux jumpbox into the BC Gov Azure Landing Zone using the bundled Terraform. Run this as a step inside a job that sets `environment:` (for OIDC + environment-scoped secrets) and grants `id-token: write`.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 13, 2026
License
Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned
uses: bcgov/action-deployer-vm-bastion-alz@97815793db79d6e0c5b95f5f43d2618173ea1f36 # v1.0.1

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
app_nameApplication name. Used for resource naming and the Terraform state key.yes
app_envApplication environment (e.g. tools, dev, test, prod).yes
terraform_commandTerraform operation to run: apply, plan, or destroy.noapply
tfvars_filePath (relative to the caller's checked-out workspace) to a .tfvars file. Staged as terraform.tfvars.no""
locationAzure region. Overrides tfvars when set.noCanada Central
resource_group_nameResource group name. Defaults to <app_name>-<app_env> when empty.no""
vm_sizeJumpbox VM size. Overrides tfvars when set.no""
os_disk_size_gbJumpbox OS disk size in GB. Overrides tfvars when set.no""
bastion_skuAzure Bastion SKU (Standard or Premium). Overrides tfvars when set.no""
enable_bastionDeploy Azure Bastion (true/false). Overrides tfvars when set.no""
enable_jumpboxDeploy the jumpbox VM (true/false). Overrides tfvars when set.no""
enable_bastion_automationEnable Bastion delete/recreate automation runbooks (true/false). Overrides tfvars when set.no""
enable_monitoringCreate/attach a Log Analytics Workspace and enable Bastion audit diagnostics (true/false). Set false to skip the workspace entirely. Overrides tfvars when set.no""
existing_log_analytics_workspace_idResource ID of an existing Log Analytics Workspace (BYO LAW). When set, no workspace is created. Overrides tfvars when set.no""
backend_storage_accountStorage account name holding Terraform state. Pass STORAGE_ACCOUNT_NAME (set by initial-azure-setup.sh).yes
backend_resource_groupResource group of the state storage account. Defaults to vnet_resource_group_name when empty.no""
backend_container_nameBlob container for Terraform state.notfstate
backend_state_keyState blob key. Defaults to <app_name>/<app_env>/terraform.tfstate when empty.no""
azure_client_idAzure AD app (OIDC) client ID.yes
azure_tenant_idAzure AD tenant ID.yes
azure_subscription_idTarget Azure subscription ID.yes
vnet_nameExisting spoke VNet name (from the platform team).yes
vnet_resource_group_nameResource group of the existing VNet.yes
vnet_address_spaceAddress space of the existing VNet (e.g. 10.46.115.0/24).yes
bastion_subnet_address_prefixCIDR for the AzureBastionSubnet. Must be /26 or larger (e.g. 10.46.115.64/26). Pass from a secret to keep IP ranges out of logs.yes
jumpbox_subnet_address_prefixCIDR for the jumpbox subnet (e.g. 10.46.115.128/28). Pass from a secret to keep IP ranges out of logs.yes
vm_admin_login_principal_idsComma-separated Entra object IDs (users and/or groups) granted Virtual Machine Administrator Login on the jumpbox. Required: with none, nobody can Entra-SSH in. Use object IDs (GUIDs), not UPNs / emails / display names.yes

no outputs