terraform-azurerm-vm/r-extensions.tf at 7e307736f47ae36d132cd58fdc04666777804f0c · cloudeteer/terraform-azurerm-vm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
locals {
  common_extensions = [
    {
      name                       = "NetworkWatcherAgent"
      publisher                  = "Microsoft.Azure.NetworkWatcher"
      type                       = format("NetworkWatcherAgent%s", local.image_full.operating_system)
      type_handler_version       = "1.0"
      auto_upgrade_minor_version = true
      automatic_upgrade_enabled  = true
    },
    {
      name                       = "AzureMonitorAgent"
      publisher                  = "Microsoft.Azure.Monitor"
      type                       = format("AzureMonitor%sAgent", local.image_full.operating_system)
      type_handler_version       = "1.0"
      auto_upgrade_minor_version = true
      automatic_upgrade_enabled  = true
    },
    {
      name                       = "AzurePolicy"
      publisher                  = "Microsoft.GuestConfiguration"
      type                       = format("Configurationfor%s", local.image_full.operating_system)
      type_handler_version       = "1.0"
      auto_upgrade_minor_version = true
      automatic_upgrade_enabled  = true
    },

  ]

  windows_extenstion = [
    {
      name                       = "AntiMalware"
      publisher                  = "Microsoft.Azure.Security"
      type                       = "IaaSAntimalware"
      type_handler_version       = "1.0"
      auto_upgrade_minor_version = true
      automatic_upgrade_enabled  = false
    },
  ]

  linux_extensions = []
}

resource "azurerm_virtual_machine_extension" "this" {

  for_each = {
    for element in
    concat(
      local.common_extensions,
      (local.is_windows ? local.windows_extenstion : []),
      (local.is_linux ? local.linux_extensions : [])
    ) :
    element.name => element if contains(var.extensions, element.name) && var.allow_extension_operations
  }

  virtual_machine_id = local.virtual_machine.id

  auto_upgrade_minor_version = each.value.auto_upgrade_minor_version
  automatic_upgrade_enabled  = each.value.automatic_upgrade_enabled
  name                       = each.value.name
  publisher                  = each.value.publisher
  type                       = each.value.type
  type_handler_version       = each.value.type_handler_version

  lifecycle {
    ignore_changes = [tags, type_handler_version]
  }
}

resource "azurerm_virtual_machine_extension" "entra_id_login" {

  count = var.entra_id_login.enabled ? 1 : 0

  name                 = "EntraIDLogin"
  publisher            = "Microsoft.Azure.ActiveDirectory"
  type                 = local.is_linux ? "AADSSHLoginForLinux" : "AADLoginForWindows"
  type_handler_version = "1.0"
  virtual_machine_id   = local.virtual_machine.id

  lifecycle {
    ignore_changes = [tags, type_handler_version]
  }
}

resource "azurerm_role_assignment" "entra_id_login_admin" {
  for_each = (
    var.entra_id_login.enabled
    ? toset(concat(var.entra_id_login.principal_ids, var.entra_id_login.admin_login_principal_ids))
    : []
  )

  principal_id         = each.value
  role_definition_name = "Virtual Machine Administrator Login"
  scope                = local.virtual_machine.id
}

resource "azurerm_role_assignment" "entra_id_login_user" {
  for_each = (
    var.entra_id_login.enabled ? toset(var.entra_id_login.user_login_principal_ids) : []
  )

  principal_id         = each.value
  role_definition_name = "Virtual Machine User Login"
  scope                = local.virtual_machine.id
}


resource "azurerm_virtual_machine_extension" "domain_join" {
  count = var.domain_join.enabled ? 1 : 0

  name                       = "DomainJoin"
  publisher                  = "Microsoft.Compute"
  type                       = "JsonADDomainExtension"
  type_handler_version       = "1.0"
  auto_upgrade_minor_version = true
  automatic_upgrade_enabled  = false

  virtual_machine_id = local.virtual_machine.id

  settings = jsonencode({
    Name    = var.domain_join.domain_name,
    OUPath  = var.domain_join.ou_path,
    User    = var.domain_join.join_user,
    Restart = var.domain_join.restart,
    Options = var.domain_join.options
  })

  protected_settings = jsonencode({
    Password = var.domain_join_password
  })

  lifecycle {
    ignore_changes = [tags, type_handler_version]
  }

  depends_on = [
    # The Domain Join extension restarts the virtual machine, which may conflict
    # with the installation of other extensions. To avoid such conflicts, we add
    # a dependency on the Domain Join extension.
    azurerm_virtual_machine_extension.entra_id_login,
    azurerm_virtual_machine_extension.this
  ]
}