Add bastion sku configuration

Fixes #86

Add a variable to configure Azure Bastion SKU and default to Developer (free).

* Add `bastion_sku` variable to `config.sample.yaml` with default value `Developer`.
* Add conditional logic in `core/terraform/bastion.tf` to deploy Azure Bastion based on `bastion_sku` variable.
* Update `azurerm_bastion_host` resource in `core/terraform/bastion.tf` to use `bastion_sku` variable.
* Add `bastion_sku` variable to `core/terraform/variables.tf` with default value `Developer`.
* Add `bastion_sku` variable to `config_schema.json`.
* Document the new `bastion_sku` variable in `docs/tre-admins/environment-variables.md`.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/microsoft/AzureTRE/issues/86?shareId=XXXX-XXXX-XXXX-XXXX).

config.sample.yaml

@@ -49,6 +49,9 @@ tre:
   # firewall_force_tunnel_ip: __CHANGE_ME__
   firewall_sku: Standard
   app_gateway_sku: Standard_v2
+  # See https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku 
+  # Set to Standard if wish to connect to VMs in workspaces.
+  bastion_sku: Developer
 
   # Uncomment to deploy to a custom domain
   # custom_domain: __CHANGE_ME__

config_schema.json

@@ -93,6 +93,10 @@
           "description": "SKU of the Application Gateway.",
           "type": "string"
         },
+        "bastion_sku": {
+          "description": "SKU of the Azure Bastion.",
+          "type": "string"
+        },
         "custom_domain": {
           "description": "Custom domain name.",
           "type": "string"

core/terraform/bastion.tf

@@ -20,8 +20,11 @@ resource "azurerm_bastion_host" "bastion" {
     public_ip_address_id = azurerm_public_ip.bastion.id
   }
 
+  sku {
+    name = var.bastion_sku
+  }
+
   tags = local.tre_core_tags
 
   lifecycle { ignore_changes = [tags] }
 }
-

core/terraform/variables.tf

@@ -241,3 +241,9 @@ variable "encryption_kv_name" {
   description = "Name of Key Vault for encryption keys, required only if external_key_store_id is not set (only used if enable_cmk_encryption is true)"
   default     = null
 }
+
+variable "bastion_sku" {
+  type        = string
+  description = "Azure Bastion SKU"
+  default     = "Developer"
+}

docs/tre-admins/environment-variables.md

@@ -43,6 +43,7 @@
 | `RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE` | Optional. The number of processes to instantiate when the Resource Processor starts. Equates to the number of parallel deployment operations possible in your TRE. Defaults to `5`. |
 | `FIREWALL_SKU` | Optional. The SKU of the Azure Firewall instance. Default value is `Standard`. Allowed values [`Basic`, `Standard`, `Premium`]. See [Azure Firewall SKU feature comparison](https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku). |
 | `APP_GATEWAY_SKU` | Optional. The SKU of the Application Gateway. Default value is `Standard_v2`. Allowed values [`Standard_v2`, `WAF_v2`] |
+| `BASTION_SKU` | Optional. The SKU of the Azure Bastion instance. Default value is `Developer`. Allowed values [`Developer`, `Standard`]. See [Azure Bastion SKU feature comparison](https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku). |
 | `CUSTOM_DOMAIN` | Optional. Custom domain name to access the Azure TRE portal. See [Custom domain name](custom-domain.md). |
 | `ENABLE_CMK_ENCRYPTION` | If set to `true`, customer-managed key encryption will be enabled for all supported resources. |
 ## For authentication in `/config.yaml`