Dev

.github/workflows/terraform-validate.yml

@@ -38,7 +38,7 @@ jobs:
 
     - name: Check local value for network interface names
       run: |
-        if ! grep -q 'locals {' *.tf || ! grep -Eq '(nic_names|network_interface_names)' *.tf; then
+        if ! grep -q 'locals {' *.tf || ! grep -Eq '(nic-names|network_interface_names)' *.tf; then
           echo "Local value for network interface names not found!"
           exit 1
         fi
@@ -62,15 +62,15 @@ jobs:
 
     - name: Check local value for security rules
       run: |
-        if ! grep -q 'locals {' *.tf || ! grep -Eq '(security_rules|nsg_rules)' *.tf; then
+        if ! grep -q 'locals {' *.tf || ! grep -Eq '(security-rules|nsg_rules)' *.tf; then
           echo "Local value for security rules not found!"
           exit 1
         fi
         echo "Local value for security rules is present."
 
     - name: Check built-in functions usage
       run: |
-        if ! grep -q 'upper(' *.tf || ! grep -q 'join(' *.tf || ! grep -Eq '\[for.*:' *.tf; then
+        if ! grep -q 'upper(' *.tf || ! grep -q 'join(' *.tf || ! grep -Pzo '\[\s*.*for.*:' *.tf; then
           echo "Required built-in functions not used correctly!"
           exit 1
         fi

.gitignore

@@ -0,0 +1,2 @@
+.terraform
+*.tfstate*

network.tf

@@ -0,0 +1,61 @@
+resource "azurerm_virtual_network" "main" {
+  name                = "${var.prefix}-network"
+  address_space       = ["10.0.0.0/16"]
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+}
+
+resource "azurerm_subnet" "internal" {
+  name                 = "internal"
+  resource_group_name  = azurerm_resource_group.example.name
+  virtual_network_name = azurerm_virtual_network.main.name
+  address_prefixes     = ["10.0.2.0/24"]
+}
+
+resource "azurerm_network_security_group" "main" {
+  name                = "${var.prefix}-SecurityGroup"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+
+  dynamic "security_rule" {
+    for_each = local.security-rules
+    content {
+      name                       = security_rule.value.name
+      protocol                   = security_rule.value.protocol
+      source_port_range          = security_rule.value.source_port_range
+      destination_port_range     = security_rule.value.destination_port_range
+      source_address_prefix      = security_rule.value.source_address_prefix
+      destination_address_prefix = security_rule.value.destination_address_prefix
+      access                     = security_rule.value.access
+      priority                   = security_rule.value.priority
+      direction                  = security_rule.value.direction
+    }
+  }
+
+  tags = {
+    output = "nsg-tag"
+  }
+}
+
+# No need to insert ${count.index} in resource Local_Name - Terraform handles it itself
+resource "azurerm_network_interface" "main" {
+  for_each            = toset(local.nic-names)
+  name                = each.key
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+
+  # different NIC's may have identical ip_configurations
+  ip_configuration {
+    name                          = "ip-config-${replace(each.key, "${var.prefix}-nic-", "")}"
+    subnet_id                     = azurerm_subnet.internal.id
+    private_ip_address_allocation = "Dynamic"
+    # currently we have no goal to have access from outside
+  }
+}
+
+# associates security group to with each of the NIC which are to be created
+resource "azurerm_network_interface_security_group_association" "example" {
+  for_each                  = azurerm_network_interface.main
+  network_interface_id      = each.value.id
+  network_security_group_id = azurerm_network_security_group.main.id
+}

outputs.tf

@@ -0,0 +1,23 @@
+output "vm_upper_name" {
+  value = [
+    for vm in azurerm_linux_virtual_machine.main :
+    upper(vm.name)
+  ]
+}
+
+output "join_tags" {
+  value = [
+    for vm in azurerm_linux_virtual_machine.main :
+    join("-", [
+      azurerm_network_security_group.main.tags.output,
+      vm.tags.output
+    ])
+  ]
+}
+
+output "vm-ids" {
+  value = [
+    for vm in azurerm_linux_virtual_machine.main :
+    vm.id
+  ]
+}

provider.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "3.105.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+}

resgroup.tf

@@ -0,0 +1,4 @@
+resource "azurerm_resource_group" "example" {
+  name     = "${var.prefix}-resources"
+  location = "UK South"
+}

settings.tf

@@ -0,0 +1,77 @@
+variable "prefix" {
+  type    = string
+  default = "terratask"
+}
+
+variable "vm-count" {
+  type    = number
+  default = 3
+}
+
+# in order to follow the task we iterate names not via count.index
+locals {
+  nic-names = [
+    for i in range(var.vm-count) : "${var.prefix}-nic-${i + 1}"
+  ]
+}
+
+# Work-Around to connect `count` and `for_each` indexing
+locals {
+  nic_id_map = {
+    for nic in azurerm_network_interface.main : nic.name => nic.id
+  }
+}
+
+locals {
+  description = "dynamic list of Network Security Rules"
+  /*
+  Following fields are Required
+    name                       = string
+    protocol                   = Tcp, Udp, Icmp, Esp, Ah or *
+    source_port_range          = 0 - 65535 or *
+    destination_port_range     = 0 - 65535 or *
+    source_address_prefix      = CIDR or source IP range or *
+                                 to match any IP. Tags such as VirtualNetwork,
+                                 AzureLoadBalancer and Internet can also be used.
+    destination_address_prefix = Same values available as for source_address_prefix
+    access                     = Allow / Deny
+    priority                   = 100 - 4097
+    direction                  = Inbound / Outbound
+  */
+  security-rules = [
+    {
+      name                       = "Allow-HTTP"
+      protocol                   = "Tcp"
+      source_port_range          = "*"
+      destination_port_range     = "80"
+      source_address_prefix      = "*"
+      destination_address_prefix = "*"
+      access                     = "Allow"
+      priority                   = 101
+      direction                  = "Inbound"
+    },
+    {
+      name                       = "Allow-HTTPS"
+      protocol                   = "Tcp"
+      source_port_range          = "*"
+      destination_port_range     = "443"
+      source_address_prefix      = "*"
+      destination_address_prefix = "*"
+      access                     = "Allow"
+      priority                   = 102
+      direction                  = "Inbound"
+    }
+  ]
+}
+
+variable "vm_user" {
+  description = "Admin username"
+  type        = string
+  default     = "testadmin"
+}
+
+variable "vm_pass" {
+  description = "Admin password"
+  type        = string
+  default     = "Password1234!"
+}

vm.tf

@@ -0,0 +1,38 @@
+# azurerm_virtual_machine is superseded by >>
+resource "azurerm_linux_virtual_machine" "main" {
+  count                           = var.vm-count
+  name                            = "${var.prefix}-vm-${count.index + 1}"
+  resource_group_name             = azurerm_resource_group.example.name
+  location                        = azurerm_resource_group.example.location
+  size                            = "Standard_B1s"
+  admin_username                  = var.vm_user
+  admin_password                  = var.vm_pass
+  disable_password_authentication = false
+  # refers to relevantly indexed NIC
+  network_interface_ids = [
+    local.nic_id_map["${var.prefix}-nic-${count.index + 1}"]
+  ]
+
+  # Premium SSD \ Local redundancy \ 64 Gb - to meet free subscription req's
+  os_disk {
+    name                 = "myosdisk${count.index + 1}"
+    caching              = "ReadWrite"
+    disk_size_gb         = "64"
+    storage_account_type = "Premium_LRS"
+  }
+
+  source_image_reference {
+    publisher = "Canonical"
+    offer     = "0001-com-ubuntu-server-jammy"
+    sku       = "22_04-lts"
+    version   = "latest"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  tags = {
+    output = "vm-tag"
+  }
+}