101-backup-vm

quickstart/101-backup-vm/main.tf

@@ -0,0 +1,178 @@
+resource "random_pet" "rg_name" {
+  prefix = var.resource_group_name_prefix
+}
+
+resource "azurerm_resource_group" "rg" {
+  location = var.resource_group_location
+  name     = random_pet.rg_name.id
+}
+
+resource "random_string" "name" {
+  length  = 12
+  lower   = true
+  upper   = false
+  numeric = false
+  special = false
+}
+
+# Create virtual network
+resource "azurerm_virtual_network" "my_terraform_network" {
+  name                = "${random_string.name.id}-vnet"
+  address_space       = ["10.0.0.0/16"]
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+}
+
+# Create subnet
+resource "azurerm_subnet" "my_terraform_subnet" {
+  name                 = "${random_string.name.id}-subnet"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.my_terraform_network.name
+  address_prefixes     = ["10.0.1.0/24"]
+}
+
+# Create public IPs
+resource "azurerm_public_ip" "my_terraform_public_ip" {
+  name                = "${random_string.name.id}-public-ip"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+  allocation_method   = "Dynamic"
+}
+
+# Create Network Security Group and rules
+resource "azurerm_network_security_group" "my_terraform_nsg" {
+  name                = "${random_string.name.id}-nsg"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  security_rule {
+    name                       = "RDP"
+    priority                   = 1000
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "*"
+    source_port_range          = "*"
+    destination_port_range     = "3389"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+  security_rule {
+    name                       = "web"
+    priority                   = 1001
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "Tcp"
+    source_port_range          = "*"
+    destination_port_range     = "80"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+}
+
+# Create network interface
+resource "azurerm_network_interface" "my_terraform_nic" {
+  name                = "${random_string.name.id}-nic"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+
+  ip_configuration {
+    name                          = "my_nic_configuration"
+    subnet_id                     = azurerm_subnet.my_terraform_subnet.id
+    private_ip_address_allocation = "Dynamic"
+    public_ip_address_id          = azurerm_public_ip.my_terraform_public_ip.id
+  }
+}
+
+# Connect the security group to the network interface
+resource "azurerm_network_interface_security_group_association" "example" {
+  network_interface_id      = azurerm_network_interface.my_terraform_nic.id
+  network_security_group_id = azurerm_network_security_group.my_terraform_nsg.id
+}
+
+# Create storage account for boot diagnostics
+resource "azurerm_storage_account" "my_storage_account" {
+  name                     = "diag${random_id.random_id.hex}"
+  location                 = azurerm_resource_group.rg.location
+  resource_group_name      = azurerm_resource_group.rg.name
+  account_tier             = "Standard"
+  account_replication_type = "LRS"
+}
+
+# Create virtual machine
+resource "azurerm_windows_virtual_machine" "main" {
+  name                              = "${random_string.name.id}-vm"
+  admin_username                    = "azureuser"
+  admin_password                    = random_password.password.result
+  location                          = azurerm_resource_group.rg.location
+  resource_group_name               = azurerm_resource_group.rg.name
+  network_interface_ids             = [azurerm_network_interface.my_terraform_nic.id]
+  size                              = "Standard_DS1_v2"
+  vm_agent_platform_updates_enabled = true
+
+  os_disk {
+    name                 = "myOsDisk"
+    caching              = "ReadWrite"
+    storage_account_type = "Premium_LRS"
+  }
+
+  source_image_reference {
+    publisher = "MicrosoftWindowsServer"
+    offer     = "WindowsServer"
+    sku       = "2022-datacenter-azure-edition"
+    version   = "latest"
+  }
+
+
+  boot_diagnostics {
+    storage_account_uri = azurerm_storage_account.my_storage_account.primary_blob_endpoint
+  }
+}
+
+# Generate random text for a unique storage account name
+resource "random_id" "random_id" {
+  keepers = {
+    # Generate a new ID only when a new resource group is defined
+    resource_group = azurerm_resource_group.rg.name
+  }
+
+  byte_length = 8
+}
+
+resource "random_password" "password" {
+  length      = 20
+  min_lower   = 1
+  min_upper   = 1
+  min_numeric = 1
+  min_special = 1
+  special     = true
+}
+
+resource "azurerm_recovery_services_vault" "example" {
+  name                = "${random_string.name.id}-vault"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  sku                 = "Standard"
+  soft_delete_enabled = var.soft_delete_enabled
+}
+
+resource "azurerm_backup_policy_vm" "example" {
+  name                = "${random_string.name.id}-policy"
+  resource_group_name = azurerm_resource_group.rg.name
+  recovery_vault_name = azurerm_recovery_services_vault.example.name
+
+  backup {
+    frequency = "Daily"
+    time      = "23:00"
+  }
+
+  retention_daily {
+    count = 7
+  }
+}
+
+resource "azurerm_backup_protected_vm" "example" {
+  resource_group_name = azurerm_resource_group.rg.name
+  recovery_vault_name = azurerm_recovery_services_vault.example.name
+  source_vm_id        = azurerm_windows_virtual_machine.main.id
+  backup_policy_id    = azurerm_backup_policy_vm.example.id
+}

quickstart/101-backup-vm/outputs.tf

@@ -0,0 +1,24 @@
+output "resource_group_name" {
+  value = azurerm_resource_group.rg.name
+}
+
+output "azurerm_recovery_services_vault_name" {
+  value = azurerm_recovery_services_vault.example.name
+}
+
+output "azurerm_backup_policy_vm_name" {
+  value = azurerm_backup_policy_vm.example.name
+}
+
+output "azurerm_windows_virtual_machine_name" {
+  value = azurerm_windows_virtual_machine.main.name
+}
+
+output "public_ip_address" {
+  value = azurerm_windows_virtual_machine.main.public_ip_address
+}
+
+output "admin_password" {
+  sensitive = true
+  value     = azurerm_windows_virtual_machine.main.admin_password
+}

quickstart/101-backup-vm/providers.tf

@@ -0,0 +1,23 @@
+terraform {
+  required_version = ">=1.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~>3.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~>3.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {
+    recovery_service {
+      vm_backup_stop_protection_and_retain_data_on_destroy = true
+      purge_protected_items_from_vault_on_destroy          = true
+    }
+  }
+}

quickstart/101-backup-vm/readme.md

@@ -0,0 +1,30 @@
+# Azure Backup VM
+
+This sampe code is used to create a variety of resources in Azure. So that you can run the code multiple times without naming collisions, the code starts by creating a randomly named resource group. In addition, a random string of 12 lowercase letters is generated that is used to name the other resource: virtual network, subnet, public IP, network security group, network interface, storage account, and Windows virtual machine. The network security group includes rules for allowing inbound RDP and web traffic. The network interface is associated with the subnet and the public IP, and it is also associated with the network security group. The storage account is used for boot diagnostics for the virtual machine. The virtual machine is a Windows machine, and it is associated with the network interface. A random password is generated for the admin user of the virtual machine. A recovery services vault is created, along with a backup policy for daily backups with a retention period of 7 days. Finally, the virtual machine is protected by associating it with the backup policy. Note that a variable named `soft_delete_enabled` allows you to whether *soft delete* is enabled for the recovery services vault.  for more information about the recovery services vault attributes (including soft_delete_enabled) see the [azurerm_recovery_services_vault reference documentation](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/recovery_services_vault.html).
+
+## Resources
+
+- [random_pet](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet)
+- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
+- [random_string](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string)
+- [azurerm_virtual_network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network)
+- [azurerm_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)
+- [azurerm_public_ip](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip)
+- [azurerm_network_security_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_network_security_group)
+- [azurerm_network_interface](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_network_interface)
+- [azurerm_network_interface_security_group_association](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_network_interface_security_group_association)
+- [azurerm_storage_account](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_storage_account)
+- [azurerm_windows_virtual_machine](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_windows_virtual_machine)
+- [random_id](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id)
+- [random_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password)
+- [azurerm_recovery_services_vault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_recovery_services_vault)
+- [azurerm_backup_policy_vm](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_backup_policy_vm)
+- [azurerm_backup_protected_vm](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/azurerm_backup_protected_vm)
+
+## Variables
+
+| Name | Description | Default |
+|-|-|-|
+| `resource_group_name_prefix` | Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription. | rg |
+| `resource_group_location` | Location of the resource group. | eastus |
+| `soft_delete_enabled` | Is soft delete enable for the recovery services vault? | false |

quickstart/101-backup-vm/variables.tf

@@ -0,0 +1,18 @@
+variable "resource_group_location" {
+  type        = string
+  default     = "eastus"
+  description = "Location of the resource group."
+}
+
+variable "resource_group_name_prefix" {
+  type        = string
+  default     = "rg"
+  description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
+}
+
+variable "soft_delete_enabled" {
+  type        = bool
+  default     = false
+  nullable    = false
+  description = "Is soft delete enable for the recovery services vault?"
+}