Azure Terraform - Create a virtual machine and enable SSH and ping

george@fedora:~$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa
Generating public/private rsa key pair.
Enter passphrase for "/home/george/.ssh/id_rsa" (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/george/.ssh/id_rsa1
Your public key has been saved in /home/george/.ssh/id_rsa1.pub
The key fingerprint is:
SHA256:bXuY4jPIELXEv/cwd4JEXgZoXFZXWtVqs06/xxx george@host
The key's randomart image is:
+---[RSA 4096]----+
|     . . o+o. ..O|
|      + +.. o. +E|
|     o + o o  ...|
|    . . ..o   +. |
|     .  Soo. ..o.|
|    .   ..=+o.+.o|
|     o ...+=.=.oo|
|      o.o. .. ..+|
|        .o     .o|
+----[SHA256]-----+

george@fedora:~$ ipcalc 10.0.2.0/24
Network:        10.0.2.0/24
Netmask:        255.255.255.0 = 24
Broadcast:      10.0.2.255

Address space:  Private Use
HostMin:        10.0.2.1
HostMax:        10.0.2.254
Hosts/Net:      254

terraform apply -auto-approve

Apply complete! Resources: 8 added, 0 changed, 0 destroyed.

Outputs:

admin_username = "azureuser"
public_ip_address = "x.y.z.t"

azurerm_resource_group.main: Refreshing state... [id=/subscriptions/xxx-c84d-459e-bc17-xx/resourceGroups/debian-vm-rg]
azurerm_virtual_network.main: Refreshing state... [id=/subscriptions/xx-c84d-459e-bc17-xx/resourceGroups/debian-vm-rg/providers/Microsoft.Network/virtualNetworks/debian12-vm-vnet]
[..]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # azurerm_linux_virtual_machine.main will be destroyed
  - resource "azurerm_linux_virtual_machine" "main" {
      - admin_username                                         = "azureuser" -> null
      - allow_extension_operations                             = true -> null
      - bypass_platform_safety_checks_on_user_schedule_enabled = false -> null
      - computer_name                                          = "debian12-vm" -> null
      - disable_password_authentication                        = true -> null
      - disk_controller_type                                   = "SCSI" -> null
      - encryption_at_host_enabled                             = false -> null
      - extensions_time_budget                                 = "PT1H30M" -> null
      - id                                                     = "/subscriptions/xx-c84d-459e-bc17-xx/resourceGroups/debian-vm-rg/providers/Microsoft.Compute/virtualMachines/debian12-vm" -> null
      - location                                               = "uksouth" -> null
      - max_bid_price                                          = -1 -> null
      - name                                                   = "debian12-vm" -> null
      - network_interface_ids                                  = [
          - "/subscriptions/xx-c84d-459e-bc17-xx/resourceGroups/debian-vm-rg/providers/Microsoft.Network/networkInterfaces/debian12-vm-nic",
        ] -> null
      - patch_assessment_mode                                  = "ImageDefault" -> null
      - patch_mode                                             = "ImageDefault" -> null
      - platform_fault_domain                                  = -1 -> null
      - priority                                               = "Regular" -> null
      - private_ip_address                                     = "10.0.2.4" -> null
      - private_ip_addresses                                   = [
          - "10.0.2.4",
        ] -> null
      - provision_vm_agent                                     = true -> null
      - public_ip_address                                      = "x.y.z.t" -> null
      - public_ip_addresses                                    = [
          - "x.y.z.t",
        ] -> null
      - resource_group_name                                    = "debian-vm-rg" -> null
      - secure_boot_enabled                                    = false -> null
      - size                                                   = "Standard_B1s" -> null
      - tags                                                   = {} -> null
      - virtual_machine_id                                     = "xxx-8bd8-45e3-a2ca-851381933651" -> null
      - vm_agent_platform_updates_enabled                      = false -> null
      - vtpm_enabled                                           = false -> null
        # (13 unchanged attributes hidden)

      - admin_ssh_key {
          - public_key = "ssh-rsa xxx= george@host" -> null
          - username   = "azureuser" -> null
        }

      - os_disk {
          - caching                          = "ReadWrite" -> null
          - disk_size_gb                     = 30 -> null
          - name                             = "debian12-vm_OsDisk_1_6d9d5c0e7d574xxx" -> null
          - storage_account_type             = "Standard_LRS" -> null
          - write_accelerator_enabled        = false -> null
            # (3 unchanged attributes hidden)
        }

      - source_image_reference {
          - offer     = "debian-12" -> null
          - publisher = "Debian" -> null
          - sku       = "12-gen2" -> null
          - version   = "latest" -> null
        }
    }

[..]

# Configure the AzureRM Provider
terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      # Using ~> 3.0 as it seemed to work with your environment and lock file after upgrade
      version = "~> 3.0"
    }
  }

  required_version = ">= 1.0.0"
}

provider "azurerm" {
  features {}
}

# --- Variables ---

variable "location" {
  description = "Azure region for deployment"
  type        = string
  default     = "uksouth" # Defaulting to UK South
}

variable "resource_group_name" {
  description = "Name of the resource group"
  type        = string
  default     = "debian-vm-rg" # Default resource group name
}

variable "vm_name" {
  description = "Name of the Virtual Machine"
  type        = string
  default     = "debian12-vm" # Default VM name
}

variable "admin_username" {
  description = "Username for the VM administrator account"
  type        = string
  default     = "azureuser" # Default admin username
}

variable "ssh_public_key" {
  description = "SSH public key to use for VM authentication"
  type        = string
  # Setting the default value directly in the file using your specific key
  default     = "ssh-rsa xxx= george@host"
}

variable "vm_size" {
  description = "Size of the Virtual Machine"
  type        = string
  default     = "Standard_B1s" # Smallest instance size
}

# --- Resources ---

# Create a Resource Group
resource "azurerm_resource_group" "main" {
  name     = var.resource_group_name
  location = var.location
}

# Create a Virtual Network
resource "azurerm_virtual_network" "main" {
  name                = "${var.vm_name}-vnet"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  address_space       = ["10.0.0.0/16"]
}

# Create a Subnet
resource "azurerm_subnet" "internal" {
  name                 = "internal"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.2.0/24"]
}

# Create a Public IP Address
resource "azurerm_public_ip" "main" {
  name                = "${var.vm_name}-pip"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  allocation_method   = "Static"
  sku                 = "Standard" # Standard SKU is recommended
}

# Create a Network Security Group (NSG)
resource "azurerm_network_security_group" "main" {
  name                = "${var.vm_name}-nsg"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  # Allow SSH (TCP port 22)
  security_rule {
    name                       = "AllowSSH"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "Internet" # Consider restricting this to specific IPs
    destination_address_prefix = "*"
  }

  # Allow Ping (ICMP)
  security_rule {
    name                       = "AllowPing"
    priority                   = 110 # Must have a different priority
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Icmp"
    source_port_range          = "*"
    destination_port_range     = "*" # ICMP doesn't use destination ports
    source_address_prefix      = "Internet" # Consider restricting this to specific IPs
    destination_address_prefix = "*"
  }
}

# Create a Network Interface (NIC)
resource "azurerm_network_interface" "main" {
  name                = "${var.vm_name}-nic"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.internal.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.main.id
  }

  # NSG Association is done using a separate resource (see below)
}

# Associate the Network Interface with the Network Security Group
resource "azurerm_network_interface_security_group_association" "main" {
  network_interface_id      = azurerm_network_interface.main.id
  network_security_group_id = azurerm_network_security_group.main.id
}

# Create the Linux Virtual Machine
resource "azurerm_linux_virtual_machine" "main" {
  name                = var.vm_name
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  size                = var.vm_size # Use the variable VM size (Standard_B1s)
  admin_username      = var.admin_username
  network_interface_ids = [azurerm_network_interface.main.id] # Link the VM to the NIC

  # Configure the OS image - Debian 12 (Bookworm)
  source_image_reference {
    publisher = "Debian"
    offer     = "debian-12"
    sku       = "12-gen2" # Use the Gen2 SKU (ensure VM size supports Gen2)
    version   = "latest"
  }

  # Configure the OS disk
  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS" # Cheapest storage option
    disk_size_gb         = 30             # 30 GB disk size
  }

  # Configure SSH access using the public key - Relying on implicit injection by Azure/VMAccess during creation
  admin_ssh_key {
    username   = var.admin_username
    public_key = var.ssh_public_key # Use the variable SSH public key
  }

  # Optional: Enable password authentication (less secure - use SSH keys instead)
  # disable_password_authentication = false

  # Optional: Boot Diagnostics (useful for troubleshooting boot issues)
  # boot_diagnostics {
  #   storage_account_uri = "YOUR_STORAGE_ACCOUNT_BLOB_ENDPOINT" # Requires a storage account
  # }
}

# --- Removed the explicit VM Access Extension resource and the data block ---
# They are not included in this version to avoid the "Invalid data source" error.


# --- Outputs ---

# Output the Public IP address
output "public_ip_address" {
  description = "The public IP address of the Virtual Machine"
  value       = azurerm_public_ip.main.ip_address
}

# Output the Admin Username
output "admin_username" {
  description = "The admin username for the Virtual Machine"
  value       = azurerm_linux_virtual_machine.main.admin_username
}