<p>This provisions the host with a more restrictive ssh rule.</p>
<p>Add this to <code>variables.tf</code>:</p>
<pre><code>variable &quot;source_address_prefix&quot; {
  type        = string
  description = &quot;Source IP address allowed to make ssh connections.&quot;
}
</code></pre>
<p>Change the security rule to this:</p>
<pre><code>  security_rule {
    name                       = &quot;ssh&quot;
    priority                   = 1001
    direction                  = &quot;Inbound&quot;
    access                     = &quot;Allow&quot;
    protocol                   = &quot;Tcp&quot;
    source_port_range          = &quot;*&quot;
    destination_port_range     = &quot;22&quot;
    source_address_prefix      = var.source_address_prefix
    destination_address_prefix = &quot;*&quot;
  }
</code></pre>
<p>Set this environment variable (use the actual public IP address you use to connect):</p>
<pre><code>export TF_VAR_source_address_prefix=192.168.1.1
</code></pre>
<p>Provision:</p>
<pre><code>terraform apply
</code></pre>
<p>Verify no more connection attempts to the newly provisioned Azure VM.</p>

CC BY-SA 4.0
2023-05-13T05:05:45.570Z
2023-05-13T05:05:45.570Z
davejagoda
<p>After following this quick start guide <a href="https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform</a>, running <code>lastb</code> on the provisioned host shows login attempts from many IP addresses.</p>
<p>The included security rule</p>
<pre><code>  security_rule {
    name                       = &quot;SSH&quot;
    priority                   = 1001
    direction                  = &quot;Inbound&quot;
    access                     = &quot;Allow&quot;
    protocol                   = &quot;Tcp&quot;
    source_port_range          = &quot;*&quot;
    destination_port_range     = &quot;22&quot;
    source_address_prefix      = &quot;*&quot;
    destination_address_prefix = &quot;*&quot;
  }
</code></pre>
<p>is too permissive. Ideally, it would restrict the source_address to my IP address.</p>
<p>What's the best way to restrict ssh access? Some ideas:</p>
<ol>
<li>Statically configure my current IP address in <code>main.tf</code></li>
<li>Dynamically configure the security rule using my current IP address at provision time</li>
<li>Run a post-provisioning script to allow only my current IP address</li>
<li>Something else</li>
</ol>
<p>Any suggestions?</p>

<terraform><azure>
Configure Azure Terraform provider to only allow SSH access to my current IP address
davejagoda
# Configure Azure Terraform provider to only allow SSH access to my current IP address

(Asked by: username_0 on 2023-05-09)

After following this quick start guide https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform, running lastb on the provisioned host shows login attempts from many IP addresses.
The included security rule
  security_rule {
    name                       = "SSH"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

is too permissive. Ideally, it would restrict the source_address to my IP address.
What's the best way to restrict ssh access? Some ideas:

Statically configure my current IP address in main.tf
Dynamically configure the security rule using my current IP address at provision time
Run a post-provisioning script to allow only my current IP address
Something else

Any suggestions?

**Tags:** terraform, azure


---

## 1 answers

### Answer by username_0 on 2023-05-13. Score: 0 | Accepted answer

This provisions the host with a more restrictive ssh rule.
Add this to variables.tf:
variable "source_address_prefix" {
  type        = string
  description = "Source IP address allowed to make ssh connections."
}

Change the security rule to this:
  security_rule {
    name                       = "ssh"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = var.source_address_prefix
    destination_address_prefix = "*"
  }

Set this environment variable (use the actual public IP address you use to connect):
export TF_VAR_source_address_prefix=192.168.1.1

Provision:
terraform apply

Verify no more connection attempts to the newly provisioned Azure VM.


---

