CR: Decommission Azure Bastion (Non-Prod)

Jira: HM-8532 Status: Completed Executed: 2026-04-17 Owner: Leon Geldenhuys Risk: LOW | Duration: ~5m | Rollback: ~15m

Summary

Deleted bastion-eshars-nonprod (Standard SKU) from rg-eshars-nonprod to reduce non-prod infrastructure spend (~$277+/mo). VPN (OpenVPN + Entra ID) is the primary and sufficient access path for all non-prod VMs. The AzureBastionSubnet (10.1.1.0/26) is retained in the VNet so Bastion can be recreated at any SKU if needed.

Scope

Resource	Change	Environment
bastion-eshars-nonprod	Deleted (Standard SKU, 2 scale units)	nonprod
AzureBastionSubnet (10.1.1.0/26)	Retained — no change	nonprod
nsg-bastion-nonprod	Retained — no change	nonprod

Procedure

Execution Steps

az network bastion delete \
  --name bastion-eshars-nonprod \
  --resource-group rg-eshars-nonprod \
  --yes --no-wait

Verification

• Confirm resource no longer appears in rg-eshars-nonprod
• Confirm AzureBastionSubnet still present in VNet
• Confirm VPN access to VMs still functional

Rollback

Trigger: Any non-prod VM becomes unreachable via VPN and emergency access is needed.

az network bastion create \
  --name bastion-eshars-nonprod \
  --resource-group rg-eshars-nonprod \
  --vnet-name rg-eshars-nonprod \
  --location centralus \
  --sku Basic

Note

Recreate as Basic SKU (~$138/mo) rather than Standard unless native client tunneling is specifically required.

Risk Assessment

Risk	Likelihood	Impact	Mitigation
VM inaccessible if VPN fails	Low	Medium	VPN is Entra ID authenticated and has been stable; Bastion can be recreated in ~15m if needed
Developer locked out	Low	Low	All devs should have VPN client configured; no known dependency on Bastion for day-to-day access

Outcome

Executed: 2026-04-17 Result: Success Notes: Async delete completed. AzureBastionSubnet and nsg-bastion-nonprod retained. Saving ~$277+/mo on non-prod.