Answers: <p>Hashicorp recommends using provisioners only as a last resort. They recommend using the Azure VM custom_data method, or cloud-init where available.</p>
  <p>Ansible would likely be overkill unless you will need ongoing in-place configuration management. But there are ways to make VM2 securely accessible to Ansible or provsioners if necessary.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-09-21T11:58:32.883Z
Answers: 2020-09-21T11:58:32.883Z
Answers: T.H.
Body: <p>(<a href="https://discuss.hashicorp.com/t/provision-and-configure-azure-vm-in-private-subnet-file-remote-exec-cloud-init-etc/14235?u=mloskot" rel="nofollow noreferrer">Originally posted to discuss.hashicorp.com</a>)</p>
  <p>I’m setting up a basic multi-tier infrastructure composed of two Azure VMs:</p>
  <ol>
  <li>Web server (VM1) with public IP and private IP (subnet1)</li>
  <li>Data server (<strong>VM2</strong>) in <strong>private IP</strong> only (subnet2)</li>
  </ol>
  <p>Both VM-s are based on the vanilla Ubuntu Linux images available on Azure.</p>
  <p>Obviously, it’s very easy to provision (<code>apt-get</code>, Bash scripting, etc.) and configure the Web server using the <code>file</code> or <code>remote-exec</code> provisioners. I have also experimented with the <code>clout-init</code> for that purpose.</p>
  <p>Questions:</p>
  <ul>
  <li>What is the recommended method to provision and the data server?</li>
  <li>Is <code>cloud-init</code> the only option?</li>
  </ul>
  <p>AFAIU, the Terraform provisioners running via SSH are not an option because the data server (<strong>VM2</strong>) is not available at public IP.</p>
  <p>What I need to do on the <strong>VM2</strong> is:</p>
  <ul>
  <li>install some packages</li>
  <li>upload/edit some configuration files</li>
  <li>download some data files</li>
  <li>start some services</li>
  </ul>
  <p>I’m running Terraform on Windows host, so I did not try the Ansible yet, but AFAIU it operates via SSH, similarly to the Terraform <code>file</code> or <code>remote-exec</code> provisioners.</p>
  
Tags: <terraform><azure><provisioning><cloud-init>
Title: Provision and configure Azure VM in private subnet (file, remote-exec, cloud-init, etc.)
UserDisplayName: mloskot
ThreadText: # Provision and configure Azure VM in private subnet (file, remote-exec, cloud-init, etc.)
  
  (Asked by: username_0 on 2020-09-17)
  
  ([Originally posted to discuss.hashicorp.com](https://discuss.hashicorp.com/t/provision-and-configure-azure-vm-in-private-subnet-file-remote-exec-cloud-init-etc/14235?u=username_0))
  
  I’m setting up a basic multi-tier infrastructure composed of two Azure VMs:
  
  1. Web server (VM1) with public IP and private IP (subnet1)
  2. Data server (**VM2**) in **private IP** only (subnet2)
  
  Both VM-s are based on the vanilla Ubuntu Linux images available on Azure.
  
  Obviously, it’s very easy to provision (`apt-get`, Bash scripting, etc.) and configure the Web server using the `file` or `remote-exec` provisioners. I have also experimented with the `clout-init` for that purpose.
  
  Questions:
  
  * What is the recommended method to provision and the data server?
  * Is `cloud-init` the only option?
  
  AFAIU, the Terraform provisioners running via SSH are not an option because the data server (**VM2**) is not available at public IP.
  
  What I need to do on the **VM2** is:
  
  * install some packages
  * upload/edit some configuration files
  * download some data files
  * start some services
  
  I’m running Terraform on Windows host, so I did not try the Ansible yet, but AFAIU it operates via SSH, similarly to the Terraform `file` or `remote-exec` provisioners.
  
  **Tags:** terraform, azure, provisioning, cloud-init
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-09-21. Score: 1 | Accepted answer
  
  Hashicorp recommends using provisioners only as a last resort. They recommend using the Azure VM custom\_data method, or cloud-init where available.
  
  Ansible would likely be overkill unless you will need ongoing in-place configuration management. But there are ways to make VM2 securely accessible to Ansible or provsioners if necessary.
  
  
  ---
  
  