Skip to content

Instantly share code, notes, and snippets.

@audunsolemdal
Last active May 23, 2020 13:42
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save audunsolemdal/fe142282d34f94a95d781804e894192e to your computer and use it in GitHub Desktop.
Save audunsolemdal/fe142282d34f94a95d781804e894192e to your computer and use it in GitHub Desktop.
Opens up JiT on a VM. You will need to change the -Name parameter for the NetworkAccessPolicy. Originally found as AzureRM module in a Microsoft Github repo I can't seem to find. Modified to my own needs.
# ----------------------------------------------------------------------------------
#
# Copyright Microsoft Corporation
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ----------------------------------------------------------------------------------
# Requirements:
# Powershell 7.0 or newer
# Az module: Install-Module Az
<#
.SYNOPSIS
Initiate JIT network access policy request
#>
function Connect-AzVM()
{
[CmdletBinding()]
param (
[Parameter(Mandatory=$true, ParameterSetName="Default", Position=0)]
[string] $VMName,
[Parameter(Mandatory=$false, ParameterSetName="Default", Position=1)]
[string] $RGType,
[Parameter(Mandatory=$false, ParameterSetName="Default", Position=2)]
[switch] $Fast
)
$RGType = "external"
$RGName = "$RGType-vms"
if (!$fast) { # Use -Fast switch to skip JiT and waiting
Import-Module Az.Resources
$localIP = Get-NetIPAddress | Select-Object -Property IPAddress | Where-Object -Property IPAddress -Like "10.*"
[Microsoft.Azure.Commands.Security.Models.JitNetworkAccessPolicies.PSSecurityJitNetworkAccessPolicyInitiateVirtualMachine]$vm = New-Object -TypeName Microsoft.Azure.Commands.Security.Models.JitNetworkAccessPolicies.PSSecurityJitNetworkAccessPolicyInitiateVirtualMachine
$vm.Id = "/subscriptions/xxxx/resourceGroups/$RGName/providers/Microsoft.Compute/virtualMachines/$VMName"
[Microsoft.Azure.Commands.Security.Models.JitNetworkAccessPolicies.PSSecurityJitNetworkAccessPolicyInitiatePort]$port = New-Object -TypeName Microsoft.Azure.Commands.Security.Models.JitNetworkAccessPolicies.PSSecurityJitNetworkAccessPolicyInitiatePort
$port.AllowedSourceAddressPrefix = $localIP
$port.EndTimeUtc = [DateTime]::UtcNow.AddHours(2)
$port.Number = 22
$vm.Ports = (,$port)
Start-AzJitNetworkAccessPolicy -ResourceGroupName $RGName -Location "norwayeast" -Name "OP-VMs-JIT-Policy" -VirtualMachine (,$vm)
if ($?) {
Write-Host "Successfully sent JiT request, now waiting 30 secs before connecting as the port opening takes some time ..."
}
Start-Sleep 30
}
ssh -i $HOME/.ssh/id_rsa root@"$vmName".xxx.com
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment