{vm-name} — Terraform
Deploys a Linux VM (RG, VNet, subnet, NSG with SSH allow, public IP, NIC).
Prerequisites
terraform >= 1.5az login- Exported
AZ_SUB=<subscription-id>env var - SSH public key at
~/.ssh/id_rsa.pub
Quickstart
MY_IP=$(curl -s ifconfig.me)/32 # your current public IP, locked to /32
terraform init
terraform plan -var "vm_name=dev-vm" -var "admin_public_key=$(cat ~/.ssh/id_rsa.pub)" -var "subscription_id=$AZ_SUB" -var "resource_group_name=dev-vm-rg" -var "ssh_source_address_prefix=$MY_IP"
terraform apply -var "vm_name=dev-vm" -var "admin_public_key=$(cat ~/.ssh/id_rsa.pub)" -var "subscription_id=$AZ_SUB" -var "resource_group_name=dev-vm-rg" -var "ssh_source_address_prefix=$MY_IP"Variables (see variables.tf)
| Variable | Type | Default | Notes |
|---|---|---|---|
subscription_id * |
string | — | Azure subscription |
resource_group_name * |
string | — | RG will be created |
vm_name * |
string | — | VM resource name |
admin_public_key * |
string (sensitive) | — | Contents of id_rsa.pub |
ssh_source_address_prefix * |
string | — | Your public IP as <ip>/32 or a trusted CIDR. "*" opens port 22 to the internet — only pass it if you have accepted that risk. |
location |
string | eastus |
Azure region |
size |
string | Standard_D2s_v5 |
Verify with compute_vm_list-skus |
admin_username |
string | azureuser |
|
zone |
string | "" |
1/2/3, or empty for regional |
os_disk_type |
string | Premium_LRS |
|
os_disk_size_gb |
number | 30 |
|
tags |
map(string) | {} |
* = required (no default).
Outputs (see outputs.tf)
vm_id— full ARM resource IDpublic_ip— connect withssh {admin_username}@{public_ip}
VMSS variant
Replace azurerm_linux_virtual_machine with azurerm_linux_virtual_machine_scale_set; add instances, upgrade_mode = "Manual" | "Automatic" | "Rolling". Inline NIC inside the scale set via network_interface { ip_configuration { ... } }.
Notes
ssh_source_address_prefix is required because an open SSH port is a credential-stuffing target within minutes of going public. Always pass <your-ip>/32 (or a trusted CIDR) — even for dev. For production, also add managed identity, diagnostics, and backup.
Cleanup
terraform destroy -var "vm_name=dev-vm" -var "admin_public_key=$(cat ~/.ssh/id_rsa.pub)" -var "subscription_id=$AZ_SUB" -var "resource_group_name=dev-vm-rg" -var "ssh_source_address_prefix=$MY_IP" -auto-approve