<p>Hashicorp recommends using provisioners only as a last resort. They recommend using the Azure VM custom_data method, or cloud-init where available.</p>
<p>Ansible would likely be overkill unless you will need ongoing in-place configuration management. But there are ways to make VM2 securely accessible to Ansible or provsioners if necessary.</p>

CC BY-SA 4.0
2020-09-21T11:58:32.883Z
2020-09-21T11:58:32.883Z
T.H.
<p>(<a href="https://discuss.hashicorp.com/t/provision-and-configure-azure-vm-in-private-subnet-file-remote-exec-cloud-init-etc/14235?u=mloskot" rel="nofollow noreferrer">Originally posted to discuss.hashicorp.com</a>)</p>
<p>I’m setting up a basic multi-tier infrastructure composed of two Azure VMs:</p>
<ol>
<li>Web server (VM1) with public IP and private IP (subnet1)</li>
<li>Data server (<strong>VM2</strong>) in <strong>private IP</strong> only (subnet2)</li>
</ol>
<p>Both VM-s are based on the vanilla Ubuntu Linux images available on Azure.</p>
<p>Obviously, it’s very easy to provision (<code>apt-get</code>, Bash scripting, etc.) and configure the Web server using the <code>file</code> or <code>remote-exec</code> provisioners. I have also experimented with the <code>clout-init</code> for that purpose.</p>
<p>Questions:</p>
<ul>
<li>What is the recommended method to provision and the data server?</li>
<li>Is <code>cloud-init</code> the only option?</li>
</ul>
<p>AFAIU, the Terraform provisioners running via SSH are not an option because the data server (<strong>VM2</strong>) is not available at public IP.</p>
<p>What I need to do on the <strong>VM2</strong> is:</p>
<ul>
<li>install some packages</li>
<li>upload/edit some configuration files</li>
<li>download some data files</li>
<li>start some services</li>
</ul>
<p>I’m running Terraform on Windows host, so I did not try the Ansible yet, but AFAIU it operates via SSH, similarly to the Terraform <code>file</code> or <code>remote-exec</code> provisioners.</p>

<terraform><azure><provisioning><cloud-init>
Provision and configure Azure VM in private subnet (file, remote-exec, cloud-init, etc.)
mloskot
# Provision and configure Azure VM in private subnet (file, remote-exec, cloud-init, etc.)

(Asked by: username_0 on 2020-09-17)

([Originally posted to discuss.hashicorp.com](https://discuss.hashicorp.com/t/provision-and-configure-azure-vm-in-private-subnet-file-remote-exec-cloud-init-etc/14235?u=username_0))

I’m setting up a basic multi-tier infrastructure composed of two Azure VMs:

1. Web server (VM1) with public IP and private IP (subnet1)
2. Data server (**VM2**) in **private IP** only (subnet2)

Both VM-s are based on the vanilla Ubuntu Linux images available on Azure.

Obviously, it’s very easy to provision (`apt-get`, Bash scripting, etc.) and configure the Web server using the `file` or `remote-exec` provisioners. I have also experimented with the `clout-init` for that purpose.

Questions:

* What is the recommended method to provision and the data server?
* Is `cloud-init` the only option?

AFAIU, the Terraform provisioners running via SSH are not an option because the data server (**VM2**) is not available at public IP.

What I need to do on the **VM2** is:

* install some packages
* upload/edit some configuration files
* download some data files
* start some services

I’m running Terraform on Windows host, so I did not try the Ansible yet, but AFAIU it operates via SSH, similarly to the Terraform `file` or `remote-exec` provisioners.

**Tags:** terraform, azure, provisioning, cloud-init


---

## 1 answers

### Answer by username_1 on 2020-09-21. Score: 1 | Accepted answer

Hashicorp recommends using provisioners only as a last resort. They recommend using the Azure VM custom\_data method, or cloud-init where available.

Ansible would likely be overkill unless you will need ongoing in-place configuration management. But there are ways to make VM2 securely accessible to Ansible or provsioners if necessary.


---

