Azure Developer VM: Azure VM with AADSSHLoginForLinux extension, auto shutdown and VM AD login roles

dev_vm.tf

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }

    azuread = {
      source  = "hashicorp/azuread"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "northeurope"
}

resource "azurerm_virtual_network" "example" {
  name                = "example-network"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example" {
  name                 = "internal"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.2.0/24"]
}

resource "azurerm_public_ip" "example" {
  name                = "example-public-ip"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  allocation_method   = "Dynamic"
  sku                 = "Basic"
}

resource "azurerm_network_interface" "example" {
  name                = "example-nic"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.example.id
  }
}

resource "azurerm_network_security_group" "example" {
  name                = "example-nsg"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  security_rule {
    name                       = "AllowSSHFromMyIP"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "SET ME"  # curl ifconfig.me | pbcopy
    destination_address_prefix = "*"
  }
}

data "azuread_group" "all_users" {
  # If unsure, run this: az ad user get-member-groups --id $(az ad signed-in-user show --query mail -o tsv)
  display_name = "my cool group"
}

resource "azurerm_role_assignment" "vm_ssh" {
  scope                = resource.azurerm_resource_group.example.id
  role_definition_name = "Virtual Machine User Login"
  principal_id         = data.azuread_group.all_users.object_id
}

resource "azurerm_role_assignment" "vm_rm" {
  scope                = resource.azurerm_resource_group.example.id
  role_definition_name = "Virtual Machine Administrator Login"
  principal_id         = data.azuread_group.all_users.object_id
}

resource "azurerm_network_interface_security_group_association" "example" {
  network_interface_id      = azurerm_network_interface.example.id
  network_security_group_id = azurerm_network_security_group.example.id
}

resource "tls_private_key" "rsa_4096_example" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-machine"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_B4ms" # One of the cheapest VM sizes
  admin_username      = "dingus"
  network_interface_ids = [
    azurerm_network_interface.example.id,
  ]

  identity {
    # This is required for AADSSHLoginForLinux to work
    type = "SystemAssigned"
  }

  admin_ssh_key {
    username   = "dingus"
    public_key = tls_private_key.rsa_4096_example.public_key_openssh
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts"
    version   = "latest"
  }
}

// this stuff is expensive, dingus
resource "azurerm_dev_test_global_vm_shutdown_schedule" "after_work" {
  virtual_machine_id = azurerm_linux_virtual_machine.example.id
  location           = azurerm_resource_group.example.location
  enabled            = true

  daily_recurrence_time = "1600" # Go home early
  timezone              = "Central European Standard Time"

  notification_settings {
    enabled         = true
    time_in_minutes = "60"
    email = "configure me"
  }
}

resource "azurerm_virtual_machine_extension" "adssh" {
  virtual_machine_id   = azurerm_linux_virtual_machine.example.id

  # You can values for these fields by running this: az vm extension image list
  name                 = "AADSSHLoginForLinux"
  publisher            = "Microsoft.Azure.ActiveDirectory"
  type                 = "AADSSHLoginForLinux"
  type_handler_version = "1.0"
}

output "public_ip_address" {
  value = azurerm_public_ip.example.ip_address
}