This module is used in the Coalfire-Azure-RAMPpak FedRAMP Framework. It will create a Windows Virtual Machine using managed disks.
Learn more at Coalfire OpenSource.
- Security Core
- Region Setup
- VM
- VM Nic
- Public IP (optional)
- AKV secret
- Diagnostics extension
- Network watcher extension
This module can be called as outlined below.
- Change directories to the
Bastion
directory. - From the
/terraform/prod/us-va/mgmt/bastion
directory runterraform init
. - Run
terraform plan
to review the resources being created. - If everything looks correct in the plan output, run
terraform apply
.
provider "azurerm" {
features {}
}
module "bastion1" {
source = "github.com/Coalfire-CF/terraform-azurerm-vm-windows"
vm_name = "${local.vm_name_prefix}ba1"
vm_admin_username = var.vm_admin_username
location = var.location
resource_group_name = data.terraform_remote_state.core.outputs.core_rg_name
size = "Standard_DS2_v2"
enable_public_ip = true
subnet_id = data.terraform_remote_state.usgv_mgmt_vnet.outputs.usgv_mgmt_vnet_subnet_ids["${local.resource_prefix}-bastion-sn-1"]
private_ip_address_allocation = "Dynamic"
vm_diag_sa = data.terraform_remote_state.setup.outputs.vmdiag_endpoint
storage_account_vmdiag_name = data.terraform_remote_state.setup.outputs.storage_account_vmdiag_name
kv_id = data.terraform_remote_state.core.outputs.core_kv_id
trusted_launch = false # For now, we are not using trusted launch. Fails with the CIS marketplace image.
regional_tags = var.regional_tags
global_tags = var.global_tags
source_image_reference = {
publisher = "center-for-internet-security-inc"
offer = "cis-win-2019-stig"
sku = "cis-win-2019-stig"
version = "latest"
}
plan = {
publisher = "center-for-internet-security-inc"
name = "cis-win-2019-stig"
product = "cis-win-2019-stig"
}
vm_tags = {
OS = "Windows_STIG_2019"
Function = "Bastion"
Plane = "Management"
}
}
No requirements.
Name | Version |
---|---|
azurerm | n/a |
random | n/a |
No modules.
Name | Type |
---|---|
azurerm_key_vault_secret.xadm_pass | resource |
azurerm_network_interface.nic | resource |
azurerm_public_ip.public_ip | resource |
azurerm_virtual_machine_extension.diagnostics | resource |
azurerm_virtual_machine_extension.vm_network_watcher | resource |
azurerm_windows_virtual_machine.vm | resource |
random_password.lap | resource |
Name | Description | Type | Default | Required |
---|---|---|---|---|
availability_set_id | Azure Availability VM should be attached to | string |
null |
no |
availability_zone | Specifies an Availability Zone in which the Windows VM should be located | list(number) |
null |
no |
custom_dns_label | The DNS label to use for public access. VM name if not set. DNS will be .eastus2.cloudapp.azure.com | string |
"" |
no |
disk_caching | Type of caching used for Internal OS Disk - Must be one of [None, ReadOnly, ReadWrite] | string |
"ReadWrite" |
no |
disk_size | Size of the Disk | number |
127 |
no |
enable_public_ip | True/False if a Public IP Address should be attached to the VM | bool |
n/a | yes |
global_tags | Global level tags | map(string) |
n/a | yes |
kv_id | Key Vault Resource ID to store local admin password | string |
null |
no |
location | Azure region for resource deployment | string |
n/a | yes |
plan | VM plan from marketplace | map(string) |
{ |
no |
private_ip | Static Private IP address | string |
"" |
no |
private_ip_address_allocation | Dynamic or Static | string |
"Dynamic" |
no |
public_ip_sku | Sku for the public IP attached to the VM. Can be null if no public IP needed. |
string |
"Standard" |
no |
regional_tags | Regional level tags | map(string) |
n/a | yes |
resource_group_name | Azure Resource Group resource will be deployed in | string |
n/a | yes |
size | Azure Virtual Machine size | string |
"Standard_DS2_v2" |
no |
source_image_id | VM image from shared image gallery | string |
null |
no |
source_image_reference | VM image from shared image gallery | map(string) |
{ |
no |
storage_account_vmdiag_name | Storage Account VM diagnostics are stored in | string |
n/a | yes |
subnet_id | ID of the subnet the VM NIC should be attached to | string |
n/a | yes |
trusted_launch | Enable Trusted Launch | bool |
true |
no |
vm_admin_username | Local Administrator Name | string |
n/a | yes |
vm_diag_sa | Storage Account VM diagnostics are stored in | string |
n/a | yes |
vm_name | Azure Virtual Machine Name | string |
n/a | yes |
vm_storage_account_type | The Type of Storage Account which should back the OS Disk | string |
"StandardSSD_LRS" |
no |
vm_tags | Key/Value tags that should be added to the VM | map(string) |
{} |
no |
Name | Description |
---|---|
network_interface_ids | IDs of the VM NICs provisioned. |
network_interface_private_ip | Private IP addresses of the VM NICs |
public_ip_address | The IP address allocated for the resource. |
public_ip_dns_name | FQDN to connect to the first VM provisioned. |
public_ip_id | ID of the public IP address provisioned. |
vm_id | Virtual Machine Resource ID |
vm_name | Virtual Machine Name |
vm_system_identity | Virtual Machine System Managed Identity |
vm_xadm_kv_name | The name which the local admin password for the 'xadm' account is stored under in Key Vault |
Copyright © 2023 Coalfire Systems Inc.