The provider

The first step is to create the provider file. The provider is used to interact with the Azure APIs.

We create a file called provider-main.tf, which is used to create the interaction with Terraform and the Azure providers:

# Define Terraform provider
terraform {
  required_version = ">= 0.12"
}

# Configure the Azure provider
provider "azurerm" {
  environment = "public"
  version     = ">= 2.15.0"
  features {}
  # It is important that the following values of these variables
  #  NEVER be written to source control, and therefore should not be
  #  hard-coded with defaults and should always come from the local
  #  environment
  subscription_id = var.azure-subscription-id
  client_id       = var.azure-client-id
  client_secret   = var.azure-client-secret
  tenant_id       = var.azure-tenant-id
}

Next, we create a file called provider-variables.tf, which is used to manage the authentication variables of the Azure provider:

variable "azure-subscription-id" {
  type        = string
  description = "Azure Subscription ID"
}

variable "azure-client-id" {
  type        = string
  description = "Azure Client ID"
}

variable "azure-client-secret" {
  type        = string
  description = "Azure Client Secret"
}

variable "azure-tenant-id" {
  type        = string
  description = "Azure Tenant ID"
}

The network

The next step is to create the resource group that will host all of our Azure resources. A VNET, and a subnet within the VNET, will also be created. The subnet will host our virtual machine.

We create a file called network-main.tf to describe these resources:

# Create a resource group
resource "azurerm_resource_group" "network-rg" {
  name     = "nginx-network-rg"
  location = var.location
}

# Create the network VNET
resource "azurerm_virtual_network" "network-vnet" {
  name                = "nginx-network-vnet"
  address_space       = [var.network-vnet-cidr]
  resource_group_name = azurerm_resource_group.network-rg.name
  location            = azurerm_resource_group.network-rg.location
}

# Create a subnet for VM
resource "azurerm_subnet" "vm-subnet" {
  name                 = "nginx-vm-subnet"
  address_prefixes     = [var.vm-subnet-cidr]
  virtual_network_name = azurerm_virtual_network.network-vnet.name
  resource_group_name  = azurerm_resource_group.network-rg.name
}

Then we create a file called network-variables.tf to manage network variables:

variable "location" {
  type        = string
  description = "Azure Region"
  default     = "eastus"
}

variable "network-vnet-cidr" {
  type        = string
  description = "The CIDR of the network VNET"
}

variable "vm-subnet-cidr" {
  type        = string
  description = "The CIDR for the vm subnet"
}

Security

In this section, we will create an Azure NSG (network security group) to protect our virtual machine. The security group will allow inbound traffic in ports 22 (SSH), 80 (HTTP), and 443 (HTTPS).

Create a file called security-main.tf and add the following code:

# Create Network Security Group
resource "azurerm_network_security_group" "nginx-vm-nsg" {
  depends_on=[azurerm_resource_group.network-rg]

  name                = "nginxvm-nsg"
  location            = azurerm_resource_group.network-rg.location
  resource_group_name = azurerm_resource_group.network-rg.name

  # Allows inbound SSH from entire internet!
  security_rule {
    name                       = "Allow-SSH"
    description                = "Allow SSH"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Allow-HTTP"
    description                = "Allow HTTP"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }
}

# Associate the web NSG with the subnet
resource "azurerm_subnet_network_security_group_association" "ngx-nsg-assoc" {
  depends_on=[azurerm_resource_group.network-rg]

  subnet_id                 = azurerm_subnet.vm-subnet.id
  network_security_group_id = azurerm_network_security_group.nginx-vm-nsg.id
}

Bootstrapping script to install NGINX OSS

In this step, we will create a Bash script called install-nginx.sh to install NGINX OSS in the virtual machine:

#! /bin/bash
echo 
 "deb http://nginx.org/packages/mainline/ubuntu/ xenial nginx" 
 > /etc/apt/sources.list.d/nginx.list
echo 
 "deb-src http://nginx.org/packages/mainline/ubuntu/ xenial nginx" 
 >> /etc/apt/sources.list.d/nginx.list
wget http://nginx.org/keys/nginx_signing.key
apt-key add nginx_signing.key
apt-get update
apt-get -y install nginx

# Test NGINX is installed
nginx -v

# Start NGINX - it's enabled to start at boot by default
/etc/init.d/nginx start

Creating the virtual machine

Here we will create a file called vm-nginx-main.tf. This file will load the bootstrapping script, get a public IP address, and create a virtual machine:

# Bootstrapping Template File
data "template_file" "nginx-vm-cloud-init" {
  template = file("install-nginx.sh")
}

# Generate random password
resource "random_password" "nginx-vm-password" {
  length           = 16
  min_upper        = 2
  min_lower        = 2
  min_special      = 2
  number           = true
  special          = true
  override_special = "!@#$%&"
}

# Get a Static Public IP
resource "azurerm_public_ip" "nginx-vm-ip" {
  depends_on=[azurerm_resource_group.network-rg]

  name                = "nginxvm-ip"
  location            = azurerm_resource_group.network-rg.location
  resource_group_name = azurerm_resource_group.network-rg.name
  allocation_method   = "Static"
}

# Create Network Card for the VM
resource "azurerm_network_interface" "nginx-nic" {
  depends_on=[azurerm_resource_group.network-rg]

  name                = "nginxvm-nic"
  location            = azurerm_resource_group.network-rg.location
  resource_group_name = azurerm_resource_group.network-rg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.vm-subnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.nginx-vm-ip.id
  }
}

# Create NGINX VM
resource "azurerm_linux_virtual_machine" "nginx-vm" {
  depends_on=[azurerm_network_interface.nginx-nic]

  name                  = "nginxvm"
  location              = azurerm_resource_group.network-rg.location
  resource_group_name   = azurerm_resource_group.network-rg.name
  network_interface_ids = [azurerm_network_interface.nginx-nic.id]
  size                  = var.nginx_vm_size

  source_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "18.04-LTS"
    version   = "latest"
  }

  os_disk {
    name                 = "nginxvm-osdisk"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  computer_name  = "nginxvm"
  admin_username = var.nginx_admin_username
  admin_password = random_password.nginx-vm-password.result
  custom_data    = base64encode(data.template_file.nginx-vm-cloud-init.rendered)

  disable_password_authentication = false
}

Then we create a file called vm-nginx-variables.tf to manage variables for virtual machines:

variable "nginx_vm_size" {
  type        = string
  description = "Size (SKU) of the virtual machine to create"
}

variable "nginx_admin_username" {
  description = "Username for Virtual Machine administrator account"
  type        = string
  default     = ""
}

variable "nginx_admin_password" {
  description = "Password for Virtual Machine administrator account"
  type        = string
  default     = ""
}

Bootstrapping script to install NGINX OSS

In this step, we overwrite the Bash script used in the previous Ubuntu section to install NGINX OSS through yum during the bootstrapping of the virtual machine. Replace the install-nginx.sh file with the following:

#! /bin/bash
echo "[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/mainline/centos/7/$basearch/
gpgcheck=0
enabled=1" > /etc/yum.repos.d/nginx.repo

yum -y install nginx
systemctl enable nginx
systemctl start nginx
firewall-cmd --permanent --zone=public --add-port=80/tcp
firewall-cmd --reload

How to find Azure NGINX Plus VM images for Terraform using PowerShell

To deploy an NGINX Plus virtual machine, we will need to find the value for the Publisher, offer, and sku parameters of the Azure Marketplace source image, using PowerShell.

Start by defining the Azure region you’d like to provision into using a variable:

$Location = “East US”

Then set the a variable to hold the name of the publisher and query the list of offers. For NGINX Plus images, the publisher is called nginxinc:

$publisher = “nginxinc”
Get-AzVMImageOffer -Location $location -PublisherName $publisher | Select Offer

These are the results:

Offer
-----
nginx-plus-ent-v1
nginx-plus-v1

Next, we list SKUs for NGINX Plus. We do not want the enterprise agreement because that requires us to bring our own license. We’ll instead use the standard offering to pay for the software license by the hour:

$offer = "nginx-plus-v1"
Get-AzVMImageSku -Location $location -PublisherName $publisher -Offer $offer | `
  Select Skus

These are the resulting SKUs:

Skus
----
nginx-plus-centos7
nginx-plus-q1fy17
nginx-plus-rhel7
nginx-plus-rhel8
nginx-plus-ub1604
nginx-plus-ub1804

As we can see, there are several options for an operating system to deploy NGINX Plus on Azure: CentOS Linux 7, Red Hat Enterprise Linux 7 and 8, and Ubuntu Linux 16.04 and 18.04.

If we want to use the enterprise version of NGINX Plus, we can use the following code to list SKUs:

$offer = "nginx-plus-ent-v1"
Get-AzVMImageSku -Location $location -PublisherName $publisher -Offer $offer | `
  Select Skus

The result will be as follows:

Skus
----
nginx-plus-ent-centos7
nginx-plus-ent-rhel7
nginx-plus-ent-ub1804

The provider

The first step is to create the provider file for Terraform. The provider is used to interact with APIs.

We create a file called provider-main.tf that is used to create the interaction with Terraform and Azure providers:

# Define Terraform provider
terraform {
  required_version = ">= 0.12"
}

# Configure the Azure provider
provider "azurerm" {
  environment = "public"
  version     = ">= 2.15.0"
  features {}
  # It is important that the following values of these variables
  #  NEVER be written to source control, and therefore should not be
  #  hard-coded with defaults and should always come from the local
  #  environment
  subscription_id = var.azure-subscription-id
  client_id       = var.azure-client-id
  client_secret   = var.azure-client-secret
  tenant_id       = var.azure-tenant-id
}

Next, we create a file called provider-variables.tf that is used to manage the authentication variables of the Azure provider:

variable "azure-subscription-id" {
  type        = string
  description = "Azure Subscription ID"
}

variable "azure-client-id" {
  type        = string
  description = "Azure Client ID"
}

variable "azure-client-secret" {
  type        = string
  description = "Azure Client Secret"
}

variable "azure-tenant-id" {
  type        = string
  description = "Azure Tenant ID"
}

The network

The next step is to create the resource group that will host all of our Azure resources. A VNET, and a subnet within the VNET, will also be created. The subnet will host our virtual machine.

We create a file called network-main.tf to describe these resources:

# Create a resource group
resource "azurerm_resource_group" "network-rg" {
  name     = "nginx-network-rg"
  location = var.location
}

# Create the network VNET
resource "azurerm_virtual_network" "network-vnet" {
  name                = "nginx-network-vnet"
  address_space       = [var.network-vnet-cidr]
  resource_group_name = azurerm_resource_group.network-rg.name
  location            = azurerm_resource_group.network-rg.location
}

# Create a subnet for VM
resource "azurerm_subnet" "vm-subnet" {
  name                 = "nginx-vm-subnet"
  address_prefixes     = [var.vm-subnet-cidr]
  virtual_network_name = azurerm_virtual_network.network-vnet.name
  resource_group_name  = azurerm_resource_group.network-rg.name
}

Then, we create the file network-variables.tf to manage network variables:

variable "location" {
  type        = string
  description = "Azure Region"
  default     = "eastus"
}

variable "network-vnet-cidr" {
  type        = string
  description = "The CIDR of the network VNET"
}

variable "vm-subnet-cidr" {
  type        = string
  description = "The CIDR for the vm subnet"
}

Security

In this section, we will create an Azure NSG (network security group) to protect our virtual machine. The security group will allow inbound traffic in ports 22 (SSH), 80 (HTTP), and 443 (HTTPS).

We create a file called security-main.tf and add the following code:

# Create Network Security Group
resource "azurerm_network_security_group" "nginx-vm-nsg" {
  depends_on=[azurerm_resource_group.network-rg]

  name                = "nginxvm-nsg"
  location            = azurerm_resource_group.network-rg.location
  resource_group_name = azurerm_resource_group.network-rg.name

  security_rule {
    name                       = "Allow-SSH"
    description                = "Allow SSH"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Allow-HTTP"
    description                = "Allow HTTP"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Allow-HTTPS"
    description                = "Allow HTTPS"
    priority                   = 120
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }
}

# Associate the web NSG with the subnet
resource "azurerm_subnet_network_security_group_association" "ngx-nsg-assoc" {
  depends_on=[azurerm_resource_group.network-rg]

  subnet_id                 = azurerm_subnet.vm-subnet.id
  network_security_group_id = azurerm_network_security_group.nginx-vm-nsg.id
}

Define an NGINX Plus virtual machine

In this section, we will define a virtual machine with NGINX Plus.

First, we create a file called vm-nginx-main.tf and add code to generate a random password and a random virtual machine name:

# Generate random password
resource "random_password" "nginx-vm-password" {
  length           = 16
  min_upper        = 2
  min_lower        = 2
  min_special      = 2
  number           = true
  special          = true
  override_special = "!@#$%&"
}

# Generate a random vm name
resource "random_string" "nginx-vm-name" {
  length  = 8
  upper   = false
  number  = false
  lower   = true
  special = false
}

Then, to the same file, we add code to request a public IP address, generate a network card, and assign the public IP address to it:

# Get a Static Public IP
resource "azurerm_public_ip" "nginx-vm-ip" {
  depends_on=[azurerm_resource_group.network-rg]

  name                = "nginx-${random_string.nginx-vm-name.result}-ip"
  location            = azurerm_resource_group.network-rg.location
  resource_group_name = azurerm_resource_group.network-rg.name
  allocation_method   = "Static"
}

# Create Network Card for the VM
resource "azurerm_network_interface" "nginx-nic" {
  depends_on=[azurerm_resource_group.network-rg]

  name                = "nginx-${random_string.nginx-vm-name.result}-nic"
  location            = azurerm_resource_group.network-rg.location
  resource_group_name = azurerm_resource_group.network-rg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.vm-subnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.nginx-vm-ip.id
  }
}

Next, we add the definition to create the virtual machine with the NGINX Plus:

# Create NGINX VM
resource "azurerm_linux_virtual_machine" "nginx-vm" {
  depends_on=[azurerm_network_interface.nginx-nic]

  name                  = "nginx-${random_string.nginx-vm-name.result}-vm"
  location              = azurerm_resource_group.network-rg.location
  resource_group_name   = azurerm_resource_group.network-rg.name
  network_interface_ids = [azurerm_network_interface.nginx-nic.id]
  size                  = var.nginx_vm_size

  source_image_reference {
    publisher = var.nginx-publisher
    offer     = var.nginx-plus-offer
    sku       = "nginx-plus-ub1804"
    version   = "latest"
  }

  plan {
    name      = "nginx-plus-ub1804"
    publisher = var.nginx-publisher
    product   = var.nginx-plus-offer
  }

  os_disk {
    name                 = "nginx-${random_string.nginx-vm-name.result}-osdisk"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  computer_name  = "nginx-${random_string.nginx-vm-name.result}-vm"
  admin_username = var.nginx_admin_username
  admin_password = random_password.nginx-vm-password.result

  disable_password_authentication = false
}

Finally, we create a file called vm-nginx-variables.tf to manage variables for virtual machines:

variable "nginx_vm_size" {
  type        = string
  description = "Size (SKU) of the virtual machine to create"
}

variable "nginx_admin_username" {
  description = "Username for Virtual Machine administrator account"
  type        = string
  default     = ""
}

variable "nginx_admin_password" {
  description = "Password for Virtual Machine administrator account"
  type        = string
  default     = ""
}

variable "nginx-publisher" {
  type        = string
  description = "Publisher ID for NGINX"
  default     = "nginxinc"
}

variable "nginx-plus-offer" {
  type        = string
  description = "Offer ID for NGINX"
  default     = "nginx-plus-v1"
}

Creating the input variables file

We can provide values to our variables through the terraform.tfvars file, or exported environment variables; this will make calling the terraform command line tool simpler.

Here are the PowerShell environment variables:

$Env:TF_VAR_location = "eastus"
$Env:TF_VAR_network-vnet-cidr = "10.0.0.0/24"
$Env:TF_VAR_vm-subnet-cidr    = "10.0.0.0/26"

$Env:TF_VAR_nginx_vm_size        = "Standard_B1s"
$Env:TF_VAR_nginx_admin_username = "admin"

$Env:TF_VAR_azure-subscription-id = "complete-here"
$Env:TF_VAR_azure-client-id       = "complete-here"
$Env:TF_VAR_azure-client-secret   = "complete-here"
$Env:TF_VAR_azure-tenant-id       = "complete-here"

And here are the Bash environment variables:

export TF_VAR_location = "eastus"
export TF_VAR_network-vnet-cidr = "10.0.0.0/24"
export TF_VAR_vm-subnet-cidr    = "10.0.0.0/26"

export TF_VAR_nginx_vm_size        = "Standard_B1s"
export TF_VAR_nginx_admin_username = "admin"

export TF_VAR_azure-subscription-id = "complete-here"
export TF_VAR_azure-client-id       = "complete-here"
export TF_VAR_azure-client-secret   = "complete-here"
export TF_VAR_azure-tenant-id       = "complete-here"

When using a terraform.tsars, ensure you never commit the file to source control or share the file with others:

location          = "eastus"
network-vnet-cidr = "10.0.0.0/24"
vm-subnet-cidr    = "10.0.0.0/26"

nginx_vm_size        = "Standard_B1s"
nginx_admin_username = "admin"

azure-subscription-id = "complete-here"
azure-client-id       = "complete-here"
azure-client-secret   = "complete-here"
azure-tenant-id       = "complete-here"