{"id":1227,"date":"2026-10-12T14:09:01","date_gmt":"2026-10-12T14:09:01","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1227"},"modified":"2026-10-12T14:09:03","modified_gmt":"2026-10-12T14:09:03","slug":"terraform-lab-azure-input-variables-vms-netowork-demo","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/terraform-lab-azure-input-variables-vms-netowork-demo\/","title":{"rendered":"Terraform Lab \u2013 Azure \u2013 Input Variables \u2013 VMS & Netowork Demo"},"content":{"rendered":"\n

Continuation of Labs 1\u20134<\/strong> \u00b7 Level:<\/strong> Beginner \u00b7 Terraform:<\/strong> 1.15.9 \u00b7 AzureRM:<\/strong> 5.9.x \u00b7 Updated:<\/strong> 12 October 2026<\/p>\n\n\n\n

Objective<\/h2>\n\n\n\n

Terraform Lab \u2013 Azure \u2013 Resources \u2013 VMS & Netowork Demo<\/p>\n\n\n\n

Convert the final, consolidated Lab 4 infrastructure<\/strong> to Terraform input variables, introducing all six requested types in one exercise<\/strong> without creating any additional Azure resource or introducing new Terraform features such as data sources, modules, locals, outputs, count<\/code>, or for_each<\/code>.<\/p>\n\n\n\n

The infrastructure remains the same 13 Terraform-managed resources<\/strong>: resource group, VNet, subnet, NSG, subnet\/NSG association, two inbound security rules, two public IPs, two NICs, one Windows Server 2025 VM and one Ubuntu Server 26.04 LTS VM.<\/p>\n\n\n\n

\n

Important for existing students:<\/strong> Continue from the same Lab 4 folder and Terraform state<\/strong>. Do not start with an empty state. Keep the original resource names, region, CIDRs, VM size and passwords unchanged in terraform.tfvars<\/code> unless you intend to modify Azure resources. The only intentional representation change in this lesson is that the RDP\/SSH rules use the plural source_address_prefixes<\/code> attribute to demonstrate a set(string)<\/code> allowlist; Azure may plan in-place updates to those two rules.<\/p>\n<\/blockquote>\n\n\n\n

1. Variable types \u2014 the six required concepts<\/h2>\n\n\n\n
Terraform type<\/th>What it represents<\/th>Simple example<\/th>Where it is used in this lab<\/th><\/tr><\/thead>
string<\/code><\/td>A text value<\/td>\"production\"<\/code><\/td>Region, VM size, administrator usernames\/passwords<\/td><\/tr>
number<\/code><\/td>Integer or decimal<\/td>3<\/code>, 2.5<\/code><\/td>NSG rule priorities (100<\/code>, 110<\/code>)<\/td><\/tr>
bool<\/code><\/td>True or false<\/td>true<\/code>, false<\/code><\/td>Linux password authentication setting<\/td><\/tr>
list(type)<\/code><\/td>Ordered collection of values<\/td>[\"dev\", \"prod\"]<\/code><\/td>VNet and subnet CIDRs (list(string)<\/code>)<\/td><\/tr>
set(type)<\/code><\/td>Unique collection; order is not guaranteed<\/td>toset([\"a\", \"b\"])<\/code><\/td>Allowed source CIDRs for RDP\/SSH (set(string)<\/code>)<\/td><\/tr>
map(type)<\/code><\/td>Named keys with values of a single type<\/td>{ env = \"prod\" }<\/code><\/td>Existing resource names (map(string)<\/code>)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

A variable is declared using variable \"name\" { type = ... }<\/code>. Its value is referenced using var.name<\/code><\/strong> or, for a map value, var.resource_names[\"key\"]<\/code><\/strong>.<\/p>\n\n\n\n

Special note on sets:<\/strong> toset([\"a\", \"b\"])<\/code> is a valid Terraform expression<\/em>. In terraform.tfvars<\/code>, write a list-like literal such as [\"203.0.113.10\/32\"]<\/code>; the declared set(string)<\/code> type converts it to a set automatically. Duplicate set values are removed; use sort(tolist(...))<\/code> when an Azure argument expects a stable list.<\/p>\n\n\n\n

2. File structure<\/h2>\n\n\n\n

Use only these two files<\/strong> for the new lesson (alongside your existing Terraform state and provider lock file):<\/p>\n\n\n\n

azure-terraform-labs\/\n\u251c\u2500\u2500 main.tf           # Provider + 12 variable blocks + same 13 Azure resources\n\u251c\u2500\u2500 terraform.tfvars  # Values for all six variable types\n\u251c\u2500\u2500 terraform.tfstate # Existing state from Lab 4; protect this file\n\u2514\u2500\u2500 .terraform.lock.hcl\n<\/code><\/pre>\n\n\n\n
terraform.tfvars<\/code> is automatically loaded<\/strong> by Terraform. It is not another block of infrastructure or another Azure resource. Do not<\/strong> commit terraform.tfvars<\/code> or state files to a public repository because the example uses passwords.<\/p>\n\n\n\n
3. Complete main.tf<\/code> \u2014 same infrastructure, now with variables<\/h2>\n\n\n\n
This file is a complete replacement<\/strong> for the Lab 4 main.tf<\/code>. It contains no new resource types or resources. source_image_reference<\/code> and os_disk<\/code> remain the same existing nested resource settings; no new Terraform blocks are introduced beyond variable<\/code> declarations<\/strong>.<\/p>\n\n\n\n
# ============================================\n# PART 2 - ALL SIX VARIABLE TYPES (WINDOWS + UBUNTU)\n# Keeps the same 13 resources and images from Labs 1-4\n# ============================================\n\nterraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\n# ============================================================\n# PART 2 - TERRAFORM INPUT VARIABLES (ALL SIX TYPES)\n# ============================================================\n\n# STRING - Azure region and VM settings\nvariable \"azure_region\" {\n  description = \"Azure region for every resource in this lab.\"\n  type        = string\n}\n\nvariable \"vm_size\" {\n  description = \"Size used by both virtual machines.\"\n  type        = string\n}\n\nvariable \"admin_username\" {\n  description = \"Local administrator username on both VMs.\"\n  type        = string\n}\n\nvariable \"windows_admin_password\" {\n  description = \"Administrator password for the Windows Server VM.\"\n  type        = string\n  sensitive   = true\n}\n\nvariable \"ubuntu_admin_password\" {\n  description = \"Administrator password for the Ubuntu VM.\"\n  type        = string\n  sensitive   = true\n}\n\n# NUMBER - NSG rule priorities\nvariable \"rdp_priority\" {\n  description = \"Inbound RDP rule priority, between 100 and 4096.\"\n  type        = number\n}\n\nvariable \"ssh_priority\" {\n  description = \"Inbound SSH rule priority, between 100 and 4096.\"\n  type        = number\n}\n\n# BOOL - keep Linux password authentication enabled for this lab\nvariable \"disable_linux_password_authentication\" {\n  description = \"Must be false while ubuntu_admin_password is configured.\"\n  type        = bool\n}\n\n# LIST(STRING) - ordered Azure network address prefixes\nvariable \"vnet_address_spaces\" {\n  description = \"Address spaces configured on the Azure virtual network.\"\n  type        = list(string)\n}\n\nvariable \"subnet_address_prefixes\" {\n  description = \"Address prefixes configured on the VM subnet.\"\n  type        = list(string)\n}\n\n# SET(STRING) - unique source CIDRs permitted to use SSH\/RDP\nvariable \"admin_allowed_cidrs\" {\n  description = \"Unique public IPv4 CIDRs allowed to reach SSH and RDP.\"\n  type        = set(string)\n}\n\n# MAP(STRING) - stable names of the existing Azure resources\nvariable \"resource_names\" {\n  description = \"Resource names from Labs 1-4. Keep unchanged to retain state.\"\n  type        = map(string)\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n\n# --------------------------------------------\n# 1. Resource Group\n# --------------------------------------------\nresource \"azurerm_resource_group\" \"lab\" {\n  name     = var.resource_names[\"resource_group\"]\n  location = var.azure_region\n}\n\n# --------------------------------------------\n# 2. Virtual Network\n# --------------------------------------------\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = var.resource_names[\"virtual_network\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  address_space = var.vnet_address_spaces\n}\n\n# --------------------------------------------\n# 3. Subnet\n# --------------------------------------------\nresource \"azurerm_subnet\" \"vms\" {\n  name                 = var.resource_names[\"subnet\"]\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n\n  address_prefixes = var.subnet_address_prefixes\n}\n\n# --------------------------------------------\n# 4. Network Security Group\n# --------------------------------------------\nresource \"azurerm_network_security_group\" \"lab\" {\n  name                = var.resource_names[\"nsg\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\n# --------------------------------------------\n# 5. Associate NSG with Subnet\n# --------------------------------------------\nresource \"azurerm_subnet_network_security_group_association\" \"lab\" {\n  subnet_id                 = azurerm_subnet.vms.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\n# --------------------------------------------\n# 6. Allow RDP from approved public IPv4 CIDRs\n# --------------------------------------------\nresource \"azurerm_network_security_rule\" \"rdp\" {\n  name                        = var.resource_names[\"rdp_rule\"]\n  priority                    = var.rdp_priority\n  direction                   = \"Inbound\"\n  access                      = \"Allow\"\n  protocol                    = \"Tcp\"\n  source_port_range           = \"*\"\n  destination_port_range      = \"3389\"\n  source_address_prefixes     = sort(tolist(var.admin_allowed_cidrs))\n  destination_address_prefix  = \"*\"\n  resource_group_name         = azurerm_resource_group.lab.name\n  network_security_group_name = azurerm_network_security_group.lab.name\n}\n\n# --------------------------------------------\n# 7. Allow SSH from approved public IPv4 CIDRs\n# --------------------------------------------\nresource \"azurerm_network_security_rule\" \"ssh\" {\n  name                        = var.resource_names[\"ssh_rule\"]\n  priority                    = var.ssh_priority\n  direction                   = \"Inbound\"\n  access                      = \"Allow\"\n  protocol                    = \"Tcp\"\n  source_port_range           = \"*\"\n  destination_port_range      = \"22\"\n  source_address_prefixes     = sort(tolist(var.admin_allowed_cidrs))\n  destination_address_prefix  = \"*\"\n  resource_group_name         = azurerm_resource_group.lab.name\n  network_security_group_name = azurerm_network_security_group.lab.name\n}\n\n# --------------------------------------------\n# 8. Windows VM Public IP\n# --------------------------------------------\nresource \"azurerm_public_ip\" \"windows\" {\n  name                = var.resource_names[\"windows_public_ip\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  allocation_method = \"Static\"\n  sku               = \"Standard\"\n}\n\n# --------------------------------------------\n# 9. Windows VM Network Interface\n# --------------------------------------------\nresource \"azurerm_network_interface\" \"windows\" {\n  name                = var.resource_names[\"windows_nic\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = azurerm_subnet.vms.id\n    private_ip_address_allocation = \"Dynamic\"\n    public_ip_address_id          = azurerm_public_ip.windows.id\n  }\n}\n\n# --------------------------------------------\n# 10. Windows Server 2025 VM\n# --------------------------------------------\nresource \"azurerm_windows_virtual_machine\" \"windows\" {\n  name                = var.resource_names[\"windows_vm\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  size           = var.vm_size\n  admin_username = var.admin_username\n\n  # Keep the same Windows password used when the VM was created\n  admin_password = var.windows_admin_password\n\n  network_interface_ids = [\n    azurerm_network_interface.windows.id\n  ]\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"MicrosoftWindowsServer\"\n    offer     = \"WindowsServer\"\n    sku       = \"2025-datacenter\"\n    version   = \"latest\"\n  }\n}\n\n# --------------------------------------------\n# 11. Ubuntu VM Public IP\n# --------------------------------------------\nresource \"azurerm_public_ip\" \"ubuntu\" {\n  name                = var.resource_names[\"ubuntu_public_ip\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  allocation_method = \"Static\"\n  sku               = \"Standard\"\n}\n\n# --------------------------------------------\n# 12. Ubuntu VM Network Interface\n# --------------------------------------------\nresource \"azurerm_network_interface\" \"ubuntu\" {\n  name                = var.resource_names[\"ubuntu_nic\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = azurerm_subnet.vms.id\n    private_ip_address_allocation = \"Dynamic\"\n    public_ip_address_id          = azurerm_public_ip.ubuntu.id\n  }\n}\n\n# --------------------------------------------\n# 13. Ubuntu Server 26.04 LTS VM\n# --------------------------------------------\nresource \"azurerm_linux_virtual_machine\" \"ubuntu\" {\n  name                = var.resource_names[\"ubuntu_vm\"]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  size           = var.vm_size\n  admin_username = var.admin_username\n\n  # Training only - supplied through terraform.tfvars; keep secret\n  admin_password = var.ubuntu_admin_password\n\n  # Enable SSH password authentication\n  disable_password_authentication = var.disable_linux_password_authentication\n\n  network_interface_ids = [\n    azurerm_network_interface.ubuntu.id\n  ]\n\n  # OS Disk\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  # Ubuntu Server 26.04 LTS Gen2 Image\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
4. Complete terraform.tfvars<\/code> \u2014 values for every variable<\/h2>\n\n\n\n
Save the following as terraform.tfvars<\/code> beside main.tf<\/code><\/strong>. Before applying, replace the documentation-only public IP with your real IPv4 \/32<\/code> and replace the sample passwords. If continuing from a previously applied Lab 4, use the same passwords already configured on the VMs<\/strong>: changing them can cause VM replacement.<\/p>\n\n\n\n
# ============================================================\n# PART 2 - TERRAFORM VARIABLE VALUES\n# Save as terraform.tfvars in the SAME directory as main.tf.\n# IMPORTANT: Preserve the actual values used in Labs 1-4.\n# ============================================================\n\n# STRING\nazure_region  = \"eastus\"\nvm_size       = \"Standard_B2s_v2\"\nadmin_username = \"labadmin\"\n\n# Replace these EXAMPLE passwords with the ones used in Lab 3 and Lab 4.\n# If the VMs already exist, changing the passwords can replace the VMs.\nwindows_admin_password = \"ChangeMe!2026WinLab#\"\nubuntu_admin_password  = \"ChangeMe!2026LinuxLab#\"\n\n# NUMBER: unique NSG priorities (100-4096)\nrdp_priority = 100\nssh_priority = 110\n\n# BOOL: must remain false for Ubuntu password-based login\ndisable_linux_password_authentication = false\n\n# LIST(STRING): ordered collections\nvnet_address_spaces      = [\"10.20.0.0\/16\"]\nsubnet_address_prefixes  = [\"10.20.1.0\/24\"]\n\n# SET(STRING): Terraform converts this list-like literal to a set.\n# REPLACE 203.0.113.10\/32 with YOUR public IPv4 address\/32.\n# The example address is reserved for documentation, not your real IP.\nadmin_allowed_cidrs = [\"203.0.113.10\/32\"]\n\n# MAP(STRING): resource names must match the previous labs exactly.\nresource_names = {\n  resource_group    = \"rg-terraform-lab-eastus\"\n  virtual_network   = \"vnet-terraform-lab\"\n  subnet            = \"snet-vms\"\n  nsg               = \"nsg-terraform-lab\"\n  rdp_rule          = \"Allow-RDP\"\n  ssh_rule          = \"Allow-SSH\"\n  windows_public_ip = \"pip-win2025-lab\"\n  windows_nic       = \"nic-win2025-lab\"\n  windows_vm        = \"vm-win2025-01\"\n  ubuntu_public_ip  = \"pip-ubuntu2604-lab\"\n  ubuntu_nic        = \"nic-ubuntu2604-lab\"\n  ubuntu_vm         = \"vm-ubuntu2604-01\"\n}\n\n<\/code><\/pre>\n\n\n\n
5. How the six variable types work in the actual resources<\/h2>\n\n\n\n
5.1 string<\/code>: a single text value<\/h3>\n\n\n\n
resource \"azurerm_resource_group\" \"lab\" {\n  name     = var.resource_names[\"resource_group\"]\n  location = var.azure_region\n}\n<\/code><\/pre>\n\n\n\n
var.azure_region<\/code> becomes \"eastus\"<\/code>. The same string var.vm_size<\/code> becomes \"Standard_B2s_v2\"<\/code> on both VMs. admin_username<\/code> and the two password values are also strings.<\/p>\n\n\n\n
5.2 number<\/code>: numeric NSG priority<\/h3>\n\n\n\n
priority = var.rdp_priority\n<\/code><\/pre>\n\n\n\n
var.rdp_priority<\/code> becomes the number 100<\/code>, not<\/strong> the quoted string \"100\"<\/code>. The second rule uses 110<\/code>. Azure NSG rule priorities must be unique within the NSG<\/strong>, in the range 100\u20134096; lower values are evaluated first.<\/p>\n\n\n\n
5.3 bool<\/code>: on\/off setting on Ubuntu VM<\/h3>\n\n\n\n
disable_password_authentication = var.disable_linux_password_authentication\n<\/code><\/pre>\n\n\n\n
false<\/code> means password authentication is enabled<\/strong>, which is necessary because the Ubuntu VM has admin_password<\/code>. Do not change this setting to true<\/code> while supplying admin_password<\/code><\/strong>; AzureRM rejects that combination, and changing the setting on an existing VM can force replacement.<\/p>\n\n\n\n
5.4 list(string)<\/code>: ordered network CIDRs<\/h3>\n\n\n\n
address_space    = var.vnet_address_spaces\naddress_prefixes = var.subnet_address_prefixes\n<\/code><\/pre>\n\n\n\n
The VNet gets [\"10.20.0.0\/16\"]<\/code> and the subnet gets [\"10.20.1.0\/24\"]<\/code>. Although there is just one entry in each list, the underlying Azure arguments expect a collection.<\/p>\n\n\n\n
5.5 set(string)<\/code>: unique allowed administrator CIDRs<\/h3>\n\n\n\n
source_address_prefixes = sort(tolist(var.admin_allowed_cidrs))\n<\/code><\/pre>\n\n\n\n
For example, a student’s allowlist may later contain two distinct, trusted<\/strong> \/32<\/code> IP addresses. A set automatically eliminates duplicates. Because a set has no guaranteed order, tolist<\/code> converts it and sort<\/code> gives the Azure rule a stable list. The subnet-level NSG applies these RDP\/SSH rules across the subnet, not only to a single VM.<\/p>\n\n\n\n
5.6 map(string)<\/code>: resource-name lookup<\/h3>\n\n\n\n
name = var.resource_names[\"windows_vm\"]\n<\/code><\/pre>\n\n\n\n
This resolves to \"vm-win2025-01\"<\/code>. All existing names are grouped in one map with string keys and string values. Do not rename those entries<\/strong> if you want Terraform to continue managing the exact same deployed resources; Azure resource-name changes often force replacement.<\/p>\n\n\n\n
6. Run the lesson, in the same state directory<\/h2>\n\n\n\n
First ensure you are in the same folder used for Labs 1\u20134 and that the correct Azure subscription is selected:<\/p>\n\n\n\n
az login\naz account set --subscription \"YOUR_SUBSCRIPTION_ID\"\nexport ARM_SUBSCRIPTION_ID=\"$(az account show --query id -o tsv)\"\n\n# Check your existing resources and confirm the same state is in use.<\/em>\nterraform state list\n\n# Find your public IPv4 and update terraform.tfvars to use it with \/32.<\/em>\ncurl -4 https:\/\/api.ipify.org\n<\/code><\/pre>\n\n\n\n
Keep a private backup of your existing main.tf<\/code>, then paste the complete files above into the same directory. Check that your terraform.tfvars<\/code> passwords match the existing VMs.<\/p>\n\n\n\n
terraform fmt\nterraform validate\nterraform plan -out=lab-part2.tfplan\n<\/code><\/pre>\n\n\n\n
Review the plan carefully before applying.<\/strong> Because the Azure infrastructure should remain the same, do not approve an unexpected destroy<\/code> or -\/+<\/code> replacement<\/strong>. The two NSG rules may<\/strong> show in-place changes due to changing from source_address_prefix<\/code> to source_address_prefixes<\/code>. If you changed your own IP allowlist, rule updates are also expected. If the plan contains unexpected VM replacement, reconcile the variable values with those used in Lab 4 before proceeding.<\/p>\n\n\n\n
Once the plan is acceptable:<\/p>\n\n\n\n
terraform apply lab-part2.tfplan\nterraform state list\n<\/code><\/pre>\n\n\n\n
The final managed resource count is still 13<\/strong>; declaring variables does not<\/strong> create Azure resources. A no-change plan is possible when AzureRM normalizes equivalent rule settings, but a zero-change result is not guaranteed<\/strong> until you inspect the actual plan.<\/p>\n\n\n\n
7. Student verification checklist<\/h2>\n\n\n\n