terraform-azurerm-vm-windows

This module is used in the Coalfire-Azure-RAMPpak FedRAMP Framework. It will create a Windows Virtual Machine using managed disks.

Learn more at Coalfire OpenSource.

Dependencies

Security Core
Region Setup

Resource List

VM
VM Nic
Public IP (optional)
AKV secret
Diagnostics extension
Network watcher extension

Deployment Steps

This module can be called as outlined below.

Change directories to the Bastion directory.
From the /terraform/prod/us-va/mgmt/bastion directory run terraform init.
Run terraform plan to review the resources being created.
If everything looks correct in the plan output, run terraform apply.

Usage

provider "azurerm" {
  features {}
}

module "bastion1" {
  source = "github.com/Coalfire-CF/terraform-azurerm-vm-windows"

  vm_name                       = "${local.vm_name_prefix}ba1"
  vm_admin_username             = var.vm_admin_username
  location                      = var.location
  resource_group_name           = data.terraform_remote_state.core.outputs.core_rg_name
  size                          = "Standard_DS2_v2"
  enable_public_ip              = true
  subnet_id                     = data.terraform_remote_state.usgv_mgmt_vnet.outputs.usgv_mgmt_vnet_subnet_ids["${local.resource_prefix}-bastion-sn-1"]
  private_ip_address_allocation = "Dynamic"
  vm_diag_sa                    = data.terraform_remote_state.setup.outputs.vmdiag_endpoint
  storage_account_vmdiag_name   = data.terraform_remote_state.setup.outputs.storage_account_vmdiag_name
  kv_id                         = data.terraform_remote_state.core.outputs.core_kv_id
  trusted_launch                = false # For now, we are not using trusted launch. Fails with the CIS marketplace image.

  regional_tags                 = var.regional_tags
  global_tags                   = var.global_tags

  source_image_reference = {
    publisher = "center-for-internet-security-inc"
    offer     = "cis-win-2019-stig"
    sku       = "cis-win-2019-stig"
    version   = "latest"
  }

  plan = {
    publisher = "center-for-internet-security-inc"
    name      = "cis-win-2019-stig"
    product   = "cis-win-2019-stig"
  }

  vm_tags = {
    OS       = "Windows_STIG_2019"
    Function = "Bastion"
    Plane    = "Management"
  }
}

Requirements

No requirements.

Providers

Name	Version
azurerm	n/a
random	n/a

Modules

No modules.

Resources

Name	Type
azurerm_key_vault_secret.xadm_pass	resource
azurerm_network_interface.nic	resource
azurerm_public_ip.public_ip	resource
azurerm_virtual_machine_extension.diagnostics	resource
azurerm_virtual_machine_extension.vm_network_watcher	resource
azurerm_windows_virtual_machine.vm	resource
random_password.lap	resource

Inputs

Name	Description	Type	Default	Required
availability_set_id	Azure Availability VM should be attached to	`string`	`null`	no
availability_zone	Specifies an Availability Zone in which the Windows VM should be located	`list(number)`	`null`	no
custom_dns_label	The DNS label to use for public access. VM name if not set. DNS will be .eastus2.cloudapp.azure.com	`string`	`""`	no
disk_caching	Type of caching used for Internal OS Disk - Must be one of [None, ReadOnly, ReadWrite]	`string`	`"ReadWrite"`	no
disk_size	Size of the Disk	`number`	`127`	no
enable_public_ip	True/False if a Public IP Address should be attached to the VM	`bool`	n/a	yes
global_tags	Global level tags	`map(string)`	n/a	yes
kv_id	Key Vault Resource ID to store local admin password	`string`	`null`	no
location	Azure region for resource deployment	`string`	n/a	yes
plan	VM plan from marketplace	`map(string)`	{ "name": "cis-win-2019-stig", "product": "cis-win-2019-stig", "publisher": "center-for-internet-security-inc" }	no
private_ip	Static Private IP address	`string`	`""`	no
private_ip_address_allocation	Dynamic or Static	`string`	`"Dynamic"`	no
public_ip_sku	Sku for the public IP attached to the VM. Can be `null` if no public IP needed.	`string`	`"Standard"`	no
regional_tags	Regional level tags	`map(string)`	n/a	yes
resource_group_name	Azure Resource Group resource will be deployed in	`string`	n/a	yes
size	Azure Virtual Machine size	`string`	`"Standard_DS2_v2"`	no
source_image_id	VM image from shared image gallery	`string`	`null`	no
source_image_reference	VM image from shared image gallery	`map(string)`	{ "offer": "cis-win-2019-stig", "publisher": "center-for-internet-security-inc", "sku": "cis-win-2019-stig", "version": "latest" }	no
storage_account_vmdiag_name	Storage Account VM diagnostics are stored in	`string`	n/a	yes
subnet_id	ID of the subnet the VM NIC should be attached to	`string`	n/a	yes
trusted_launch	Enable Trusted Launch	`bool`	`true`	no
vm_admin_username	Local Administrator Name	`string`	n/a	yes
vm_diag_sa	Storage Account VM diagnostics are stored in	`string`	n/a	yes
vm_name	Azure Virtual Machine Name	`string`	n/a	yes
vm_storage_account_type	The Type of Storage Account which should back the OS Disk	`string`	`"StandardSSD_LRS"`	no
vm_tags	Key/Value tags that should be added to the VM	`map(string)`	`{}`	no

Outputs

Name	Description
network_interface_ids	IDs of the VM NICs provisioned.
network_interface_private_ip	Private IP addresses of the VM NICs
public_ip_address	The IP address allocated for the resource.
public_ip_dns_name	FQDN to connect to the first VM provisioned.
public_ip_id	ID of the public IP address provisioned.
vm_id	Virtual Machine Resource ID
vm_name	Virtual Machine Name
vm_system_identity	Virtual Machine System Managed Identity
vm_xadm_kv_name	The name which the local admin password for the 'xadm' account is stored under in Key Vault

coalfire-cf / terraform-azurerm-vm-windows Goto Github PK

terraform-azurerm-vm-windows's Introduction

terraform-azurerm-vm-windows

Dependencies

Resource List

Deployment Steps

Usage

Requirements

Providers

Modules

Resources

Inputs

Outputs

Contributing

License

Contact Us

Copyright

terraform-azurerm-vm-windows's People

Contributors

Watchers

terraform-azurerm-vm-windows's Issues

Recommend Projects

Recommend Topics

Recommend Org