Answers: <p>This provisions the host with a more restrictive ssh rule.</p>
  <p>Add this to <code>variables.tf</code>:</p>
  <pre><code>variable &quot;source_address_prefix&quot; {
    type        = string
    description = &quot;Source IP address allowed to make ssh connections.&quot;
  }
  </code></pre>
  <p>Change the security rule to this:</p>
  <pre><code>  security_rule {
      name                       = &quot;ssh&quot;
      priority                   = 1001
      direction                  = &quot;Inbound&quot;
      access                     = &quot;Allow&quot;
      protocol                   = &quot;Tcp&quot;
      source_port_range          = &quot;*&quot;
      destination_port_range     = &quot;22&quot;
      source_address_prefix      = var.source_address_prefix
      destination_address_prefix = &quot;*&quot;
    }
  </code></pre>
  <p>Set this environment variable (use the actual public IP address you use to connect):</p>
  <pre><code>export TF_VAR_source_address_prefix=192.168.1.1
  </code></pre>
  <p>Provision:</p>
  <pre><code>terraform apply
  </code></pre>
  <p>Verify no more connection attempts to the newly provisioned Azure VM.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-05-13T05:05:45.570Z
Answers: 2023-05-13T05:05:45.570Z
Answers: davejagoda
Body: <p>After following this quick start guide <a href="https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform</a>, running <code>lastb</code> on the provisioned host shows login attempts from many IP addresses.</p>
  <p>The included security rule</p>
  <pre><code>  security_rule {
      name                       = &quot;SSH&quot;
      priority                   = 1001
      direction                  = &quot;Inbound&quot;
      access                     = &quot;Allow&quot;
      protocol                   = &quot;Tcp&quot;
      source_port_range          = &quot;*&quot;
      destination_port_range     = &quot;22&quot;
      source_address_prefix      = &quot;*&quot;
      destination_address_prefix = &quot;*&quot;
    }
  </code></pre>
  <p>is too permissive. Ideally, it would restrict the source_address to my IP address.</p>
  <p>What's the best way to restrict ssh access? Some ideas:</p>
  <ol>
  <li>Statically configure my current IP address in <code>main.tf</code></li>
  <li>Dynamically configure the security rule using my current IP address at provision time</li>
  <li>Run a post-provisioning script to allow only my current IP address</li>
  <li>Something else</li>
  </ol>
  <p>Any suggestions?</p>
  
Tags: <terraform><azure>
Title: Configure Azure Terraform provider to only allow SSH access to my current IP address
UserDisplayName: davejagoda
ThreadText: # Configure Azure Terraform provider to only allow SSH access to my current IP address
  
  (Asked by: username_0 on 2023-05-09)
  
  After following this quick start guide <https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform>, running `lastb` on the provisioned host shows login attempts from many IP addresses.
  
  The included security rule
  
  ```
    security_rule {
      name                       = "SSH"
      priority                   = 1001
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "22"
      source_address_prefix      = "*"
      destination_address_prefix = "*"
    }
  
  ```
  
  is too permissive. Ideally, it would restrict the source\_address to my IP address.
  
  What's the best way to restrict ssh access? Some ideas:
  
  1. Statically configure my current IP address in `main.tf`
  2. Dynamically configure the security rule using my current IP address at provision time
  3. Run a post-provisioning script to allow only my current IP address
  4. Something else
  
  Any suggestions?
  
  **Tags:** terraform, azure
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-05-13. Score: 0 | Accepted answer
  
  This provisions the host with a more restrictive ssh rule.
  
  Add this to `variables.tf`:
  
  ```
  variable "source_address_prefix" {
    type        = string
    description = "Source IP address allowed to make ssh connections."
  }
  
  ```
  
  Change the security rule to this:
  
  ```
    security_rule {
      name                       = "ssh"
      priority                   = 1001
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "22"
      source_address_prefix      = var.source_address_prefix
      destination_address_prefix = "*"
    }
  
  ```
  
  Set this environment variable (use the actual public IP address you use to connect):
  
  ```
  export TF_VAR_source_address_prefix=192.168.1.1
  
  ```
  
  Provision:
  
  ```
  terraform apply
  
  ```
  
  Verify no more connection attempts to the newly provisioned Azure VM.
  
  
  ---
  
  