Azure Virtual Machines Overlay Terraform Module

This Overlay Terraform module can deploy Azure Windows or Linux virtual machines with support for Public IP, proximity placement group, Availability Set, boot diagnostics, data disks, and Network Security Group. It supports existing ssh keys and produces ssh key pairs for Linux VMs as needed. If you do not provide a special password for Windows VMs it generates random passwords. This module can be utilized in a SCCA compliant network.

This module requires you to use an existing NSG group. To enable this functionality, replace the input 'existing_network_security_group_name' with the current NSG group's valid resource name and you can use NSG inbound rules from the module.

SCCA Compliance

This module can be SCCA compliant and can be used in a SCCA compliant Network. Enable private endpoints and SCCA compliant network rules to make it SCCA compliant.

For more information, please read the SCCA documentation.

Contributing

If you want to contribute to this repository, feel free to to contribute to our Terraform module.

More details are available in the CONTRIBUTING.md file.

Resources Supported

• Linux Virtual Machine
• Windows Virtual Machine
• Linux VM with SQL Server
• Windows VM with SQL Server
• Managed Data Disks
• Boot Diagnostics
• Proximity Placement Group
• Availability Set
• Public IP
• Network Security Group
• Managed Identities
• Custom Data
• Additional_Unattend_Content
• SSH2 Key generation for Dev Environments
• Azure Monitoring Diagnostics
• Log Analytics Agent Installation

Module Usage

# Azurerm provider configuration
provider "azurerm" {
  features {}
}

module "mod_virtual_machine" {
  source  = "azurenoops/overlays-virtual-machine/azurerm"
  version = "x.x.x"

  # Resource Group, location, VNet and Subnet details
  existing_resource_group_name = azurerm_resource_group.linux-vm-rg.name
  location                     = var.location
  deploy_environment           = var.deploy_environment
  org_name                     = var.org_name
  workload_name                = var.workload_name

  # Lookup Network Information for VM deployment
  existing_virtual_network_resource_group_name = azurerm_virtual_network.linux-vnet.resource_group_name
  existing_virtual_network_name                = azurerm_virtual_network.linux-vnet.name
  existing_subnet_name                         = azurerm_subnet.linux-snet.name
  existing_network_security_group_name         = azurerm_network_security_group.linux-nsg.name

  # This module supports a variety of pre-configured Linux and Windows distributions.
  # See the README.md file for more pre-defined Ubuntu, Centos, and RedHat images.
  # If you use gen2 distributions, please use gen2 images with supported VM sizes.
  # To generate a random admin password, specify 'disable_password_authentication = false' 
  # To use your own password, specify a valid password with the 'admin_password' parameter 
  # To produce an SSH key pair, specify 'generate_admin_ssh_key = true'
  # To use an existing key pair, set 'admin_ssh_key_data' to the path of a valid SSH public key.  
  os_type                         = "linux"
  linux_distribution_name         = "ubuntu2004"
  virtual_machine_size            = "Standard_B2s"
  disable_password_authentication = false
  admin_username                  = "azureadmin"
  admin_password                  = "P@$$w0rd1234!"
  instances_count                 = 2 # Number of VM's to be deployed

  # The proximity placement group, Availability Set, and assigning a public IP address to VMs are all optional.
  # If you don't wish to utilize these arguments, delete them from the module. 
  enable_proximity_placement_group   = true
  enable_vm_availability_set         = true
  private_ip_address_allocation_type = "Static" # Static or Dynamic
  private_ip_address                 = ["10.0.1.36", "10.0.1.37"]

  # Network Security group port definitions for each Virtual Machine 
  # NSG association for all network interfaces to be added automatically.
  # If 'existing_network_security_group_name' is supplied, the module will use the existing NSG.
  nsg_inbound_rules = [
    {
      name                   = "ssh"
      destination_port_range = "22"
      source_address_prefix  = "*"
    },
    {
      name                   = "http"
      destination_port_range = "80"
      source_address_prefix  = "*"
    },
  ]

  # Boot diagnostics are used to troubleshoot virtual machines by default. 
  # To use a custom storage account, supply a valid name for'storage_account_name'. 
  # Passing a 'null' value will use a Managed Storage Account to store Boot Diagnostics.
  enable_boot_diagnostics = true

  # Attach a managed data disk to a Windows/Linux virtual machine. 
  # Storage account types include: #'Standard_LRS', #'StandardSSD_ZRS', #'Premium_LRS', #'Premium_ZRS', #'StandardSSD_LRS', #'UltraSSD_LRS' (UltraSSD_LRS is only accessible in regions that support availability zones).
  # Create a new data drive - connect to the VM and execute diskmanagement or fdisk.
  data_disks = [
    {
      name                 = "disk1"
      disk_size_gb         = 100
      storage_account_type = "StandardSSD_LRS"
    },
    {
      name                 = "disk2"
      disk_size_gb         = 200
      storage_account_type = "Standard_LRS"
    }
  ]

  # AAD Login is used to login to the VM using Azure Active Directory credentials.
  /* aad_login_enabled = true
  aad_login_user_objects_ids = [
    data.azuread_group.vm_users_group.object_id
  ]

  aad_login_admin_objects_ids = [
    data.azuread_group.vm_admins_group.object_id
  ] */

  # (Optional) To activate Azure Monitoring and install log analytics agents 
  # (Optional) To save monitoring logs to storage, specify'storage_account_name'.    
  log_analytics_workspace_id = azurerm_log_analytics_workspace.linux-log.id

  # Deploy log analytics agents on a virtual machine. 
  # Customer id and primary shared key for Log Analytics workspace are required.
  deploy_log_analytics_agent                 = true
  log_analytics_customer_id                  = azurerm_log_analytics_workspace.linux-log.workspace_id
  log_analytics_workspace_primary_shared_key = azurerm_log_analytics_workspace.linux-log.primary_shared_key

  # Adding additional TAG's to your Azure resources
  add_tags = {
    Example = "basic_linux_virtual_machine_using_existing_RG"
  }
}

Pre-Defined Windows and Linux VM Images

By using the linux_distribution_name or windows_distribution_name arguments with this module, you can deploy pre-defined Windows or Linux images.

Custom Virtual Machine images

If the pre-defined Windows or Linux variations are insufficient, you can supply a custom image by configuring the 'custom_image' option with appropriate values. Bootstrapping configurations such as preloading apps, application setups, and other OS customizations can all be done with custom images. More information can be found here.(https://docs.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-custom-images)

Licensed Marketplace Images

For some Marketplace images you will need to provide a 'custom_image_plan' object and accept the license terms. For more information on the please see the plan block documentation at https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine#plan.

Before using licensed Marketplace image, you may need to accept legal plan terms using the Powershell command found at https://learn.microsoft.com/en-us/cli/azure/vm/image/terms?view=azure-cli-latest#az-vm-image-terms-accept. The response from this command will provide the values needed for the custom_image_plan object.

module "virtual-machine" {
  source  = "azurenoops/overlays-virtual-machine/azurerm"
  version = "x.x.x"

# .... omitted

  os_flavor               = "linux"
  linux_distribution_name = "ubuntu2004"
  virtual_machine_size    = "Standard_B2s"
  generate_admin_ssh_key  = true
  instances_count         = 2

 os_type = "linux"
  custom_image = {
    publisher = "paloaltonetworks"
    offer     = "panorama"
    sku       = "byol"
    version   = "latest"
  }

  custom_image_plan = {
    publisher = "paloaltonetworks"
    product   = "panorama"
    name      = "byol"
  }

# .... omitted 

}

Network Security Groups

By default, network security groups are attached to Network Interface and allow just necessary traffic while blocking all others (deny-all rule). In this Terraform module, use nsg_inbound_rules to construct a Network Security Group (NSG) for a network interface and allow it to add additional rules for inbound flows.

VirtualNetwork, AzureLoadBalancer, and Internet are service tags rather than IP addresses in the Source and Destination columns. Any in the protocol column includes TCP, UDP, and ICMP. You can choose TCP, UDP, ICMP, or * when establishing a rule. In the Source and Destination columns, 0.0.0.0/0 represents all addresses.

You cannot remove the default rules, but you can override them by creating rules with higher priorities.

module "virtual-machine" {
  source  = "azurenoops/overlays-virtual-machine/azurerm"
  version = "x.x.x"

# .... omitted

  os_flavor               = "linux"
  linux_distribution_name = "ubuntu2004"
  virtual_machine_size    = "Standard_B2s"
  generate_admin_ssh_key  = true
  instances_count         = 2

  existing_network_security_group_name = azurerm_network_security_group.linux-nsg.name
  nsg_inbound_rules = [
    {
      name                   = "ssh"
      destination_port_range = "22"
      source_address_prefix  = "*"
    },

    {
      name                   = "http"
      destination_port_range = "80"
      source_address_prefix  = "*"
    },
  ]

# .... omitted

}

Using existing Network Resource Groups

On occasion, you may need to deploy resources to diffent resource group but use the existing network resource group. This module allows you to use an existing network resource group by setting the input existing_virtual_network_resource_group_name to the name of the network resource group.

```terraform
data "azurerm_virtual_network" "example" {
  name                = "nsg_mgnt_vnet_in"
  resource_group_name = "vnet-shared-hub-westeurope-001"
}

data "azurerm_network_security_group" "example" {
  name                = "nsg_mgnt_subnet_in"
  resource_group_name = "vnet-shared-hub-westeurope-001"
}

module "virtual-machine" {
   source  = "azurenoops/overlays-virtual-machine/azurerm"
  version = "x.x.x"

# .... omitted for bravity

  os_flavor               = "linux"
  linux_distribution_name = "ubuntu2004"
  virtual_machine_size    = "Standard_B2s"
  generate_admin_ssh_key  = true
  instances_count         = 2

  # Network Security group port allow definitions for each Virtual Machine
  # NSG association to be added automatically for all network interfaces.  
  existing_virtual_network_resource_group_name = data.azurerm_virtual_network.example.resource_group_name
  existing_network_security_group_name         = data.azurerm_network_security_group.example.name

# .... omitted for bravity

}

Using existing Network Security Groups

To maintain capabilities, enterprise environments require the utilization of pre-existing NSG groups. This module facilitates the use of existing network security groups. Set the input existing_network_security_group_name to use a valid NSG resource name.

data "azurerm_network_security_group" "example" {
  name                = "nsg_mgnt_subnet_in"
  resource_group_name = "vnet-shared-hub-westeurope-001"
}

module "virtual-machine" {
   source  = "azurenoops/overlays-virtual-machine/azurerm"
  version = "x.x.x"

# .... omitted for bravity

  os_flavor               = "linux"
  linux_distribution_name = "ubuntu2004"
  virtual_machine_size    = "Standard_B2s"
  generate_admin_ssh_key  = true
  instances_count         = 2

  # Network Security group port allow definitions for each Virtual Machine
  # NSG association to be added automatically for all network interfaces.  
  existing_network_security_group_name = data.azurerm_network_security_group.example.name

# .... omitted for bravity

}

Recommended naming and tagging conventions

Using tags to properly organize your Azure resources, resource groups, and subscriptions into a taxonomy. Each tag is made up of a name and a value pair. For example, you can apply the term Environment and the value Production to all production resources. See Resource name and tagging choice guide for advice on how to apply a tagging strategy.

Important : For operations, tag names are case-insensitive. A tag with a tag name is updated or retrieved, independent of casing. The resource provider, on the other hand, may preserve the casing you supply for the tag name. Cost reports will show that casing. The case of tag values is important.

An effective naming convention creates resource names by incorporating vital resource information into the name. A public IP resource for a production SharePoint workload, for example, is named pip-sharepoint-prod-westus-001 using these recommended naming conventions.

Requirements

Providers

Modules

Resources

Inputs

object({
  subnet_id = string
  private_ip_address = string
})

map(object({
    publisher = string
    offer     = string
    sku       = string
    version   = string
  }))

object({
  name = string
  product = string
  publisher = string
})

list(object({
    name                 = string
    storage_account_type = string
    disk_size_gb         = number
  }))

map(object({
    publisher = string
    offer     = string
    sku       = string
    version   = string
  }))

{
  "centos77": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "7.7",
    "version": "latest"
  },
  "centos78-gen2": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "7_8-gen2",
    "version": "latest"
  },
  "centos79-gen2": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "7_9-gen2",
    "version": "latest"
  },
  "centos81": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "8_1",
    "version": "latest"
  },
  "centos81-gen2": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "8_1-gen2",
    "version": "latest"
  },
  "centos82-gen2": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "8_2-gen2",
    "version": "latest"
  },
  "centos83-gen2": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "8_3-gen2",
    "version": "latest"
  },
  "centos84-gen2": {
    "offer": "CentOS",
    "publisher": "OpenLogic",
    "sku": "8_4-gen2",
    "version": "latest"
  },
  "coreos": {
    "offer": "CoreOS",
    "publisher": "CoreOS",
    "sku": "Stable",
    "version": "latest"
  },
  "mssql2019dev-rhel8": {
    "offer": "sql2019-rhel8",
    "publisher": "MicrosoftSQLServer",
    "sku": "sqldev",
    "version": "latest"
  },
  "mssql2019dev-ubuntu1804": {
    "offer": "sql2019-ubuntu1804",
    "publisher": "MicrosoftSQLServer",
    "sku": "sqldev",
    "version": "latest"
  },
  "mssql2019dev-ubuntu2004": {
    "offer": "sql2019-ubuntu2004",
    "publisher": "MicrosoftSQLServer",
    "sku": "sqldev",
    "version": "latest"
  },
  "mssql2019ent-rhel8": {
    "offer": "sql2019-rhel8",
    "publisher": "MicrosoftSQLServer",
    "sku": "enterprise",
    "version": "latest"
  },
  "mssql2019ent-ubuntu1804": {
    "offer": "sql2019-ubuntu1804",
    "publisher": "MicrosoftSQLServer",
    "sku": "enterprise",
    "version": "latest"
  },
  "mssql2019ent-ubuntu2004": {
    "offer": "sql2019-ubuntu2004",
    "publisher": "MicrosoftSQLServer",
    "sku": "enterprise",
    "version": "latest"
  },
  "mssql2019std-rhel8": {
    "offer": "sql2019-rhel8",
    "publisher": "MicrosoftSQLServer",
    "sku": "standard",
    "version": "latest"
  },
  "mssql2019std-ubuntu1804": {
    "offer": "sql2019-ubuntu1804",
    "publisher": "MicrosoftSQLServer",
    "sku": "standard",
    "version": "latest"
  },
  "mssql2019std-ubuntu2004": {
    "offer": "sql2019-ubuntu2004",
    "publisher": "MicrosoftSQLServer",
    "sku": "standard",
    "version": "latest"
  },
  "rhel78": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "7.8",
    "version": "latest"
  },
  "rhel78-gen2": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "78-gen2",
    "version": "latest"
  },
  "rhel79": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "7.9",
    "version": "latest"
  },
  "rhel79-gen2": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "79-gen2",
    "version": "latest"
  },
  "rhel81": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "8.1",
    "version": "latest"
  },
  "rhel81-gen2": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "81gen2",
    "version": "latest"
  },
  "rhel82": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "8.2",
    "version": "latest"
  },
  "rhel82-gen2": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "82gen2",
    "version": "latest"
  },
  "rhel83": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "8.3",
    "version": "latest"
  },
  "rhel83-gen2": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "83gen2",
    "version": "latest"
  },
  "rhel84": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "8.4",
    "version": "latest"
  },
  "rhel84-byos": {
    "offer": "rhel-byos",
    "publisher": "RedHat",
    "sku": "rhel-lvm84",
    "version": "latest"
  },
  "rhel84-byos-gen2": {
    "offer": "rhel-byos",
    "publisher": "RedHat",
    "sku": "rhel-lvm84-gen2",
    "version": "latest"
  },
  "rhel84-gen2": {
    "offer": "RHEL",
    "publisher": "RedHat",
    "sku": "84gen2",
    "version": "latest"
  },
  "ubuntu1604": {
    "offer": "UbuntuServer",
    "publisher": "Canonical",
    "sku": "16.04-LTS",
    "version": "latest"
  },
  "ubuntu1804": {
    "offer": "UbuntuServer",
    "publisher": "Canonical",
    "sku": "18.04-LTS",
    "version": "latest"
  },
  "ubuntu1904": {
    "offer": "UbuntuServer",
    "publisher": "Canonical",
    "sku": "19.04",
    "version": "latest"
  },
  "ubuntu2004": {
    "offer": "0001-com-ubuntu-server-focal-daily",
    "publisher": "Canonical",
    "sku": "20_04-daily-lts",
    "version": "latest"
  },
  "ubuntu2004-gen2": {
    "offer": "0001-com-ubuntu-server-focal-daily",
    "publisher": "Canonical",
    "sku": "20_04-daily-lts-gen2",
    "version": "latest"
  }
}

[
  "NetworkSecurityGroupEvent",
  "NetworkSecurityGroupRuleCounter"
]

[
  "1",
  "2",
  "3"
]

map(object({
    publisher = string
    offer     = string
    sku       = string
    version   = string
  }))

{
  "mssql2017dev": {
    "offer": "SQL2017-WS2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "sqldev",
    "version": "latest"
  },
  "mssql2017ent": {
    "offer": "SQL2017-WS2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "enterprise",
    "version": "latest"
  },
  "mssql2017exp": {
    "offer": "SQL2017-WS2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "express",
    "version": "latest"
  },
  "mssql2017std": {
    "offer": "SQL2017-WS2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "standard",
    "version": "latest"
  },
  "mssql2019dev": {
    "offer": "sql2019-ws2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "sqldev",
    "version": "latest"
  },
  "mssql2019ent": {
    "offer": "sql2019-ws2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "enterprise",
    "version": "latest"
  },
  "mssql2019ent-byol": {
    "offer": "sql2019-ws2019-byol",
    "publisher": "MicrosoftSQLServer",
    "sku": "enterprise",
    "version": "latest"
  },
  "mssql2019std": {
    "offer": "sql2019-ws2019",
    "publisher": "MicrosoftSQLServer",
    "sku": "standard",
    "version": "latest"
  },
  "mssql2019std-byol": {
    "offer": "sql2019-ws2019-byol",
    "publisher": "MicrosoftSQLServer",
    "sku": "standard",
    "version": "latest"
  },
  "windows2012r2dc": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2012-R2-Datacenter",
    "version": "latest"
  },
  "windows2016dc": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2016-Datacenter",
    "version": "latest"
  },
  "windows2016dccore": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2016-Datacenter-Server-Core",
    "version": "latest"
  },
  "windows2019dc": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-Datacenter",
    "version": "latest"
  },
  "windows2019dc-containers": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-Datacenter-with-Containers",
    "version": "latest"
  },
  "windows2019dc-containers-g2": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-datacenter-with-containers-g2",
    "version": "latest"
  },
  "windows2019dc-gensecond": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-datacenter-gensecond",
    "version": "latest"
  },
  "windows2019dc-gs": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-datacenter-gs",
    "version": "latest"
  },
  "windows2019dccore": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-Datacenter-Core",
    "version": "latest"
  },
  "windows2019dccore-g2": {
    "offer": "WindowsServer",
    "publisher": "MicrosoftWindowsServer",
    "sku": "2019-datacenter-core-g2",
    "version": "latest"
  }
}

Outputs

Other resources

• Windows Virtual Machine
• Linux Virtual Machine
• Linux VM running SQL Server
• Windows VM running SQL Server
• Terraform AzureRM Provider Documentation