Support for deploymentScripts resource

[scott1138]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

With provisioners being considered a last resort and TF Enterprise executions happening in ephemeral containers, it would be nice to have a way to execute commands on resources when there is no supported resource in the provider or it is a command that needs to be executed on a resource, like a VM.

See MS documentation - https://docs.microsoft.com/en-us/azure/templates/microsoft.resources/deploymentscripts?tabs=json

New or Affected Resource(s)

• azurerm_deployment_script

Potential Terraform Configuration

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.
resource "azurerm_windows_virtual_machine" "example" {
  # property definitions
}

resource "azurerm_deployment_script" "jit" {
  depends_on = [azurerm_windows_virtual_machine.example]
  name = "myScript"
  location = "centralus"
  kind = "AzurePowerShell"
  script = <<SCRIPT
$ddressPrefixes = New-Object System.Collections.Generic.List[string]
$AddressPrefixes.Add('x.x.x.x')
$AddressPrefixes.Add('x.x.x.x')
$JitPolicy = (@{
  id    = "/subscriptions/$(az_sub_id)/resourceGroups/$(resource_group_name)/providers/Microsoft.Compute/virtualMachines/${{ vm.vm_name }}";
  ports = (@{
    number                     = 3389;
    protocol                   = "*";
    allowedSourceAddressPrefixes = $AddressPrefixes;
    maxRequestAccessDuration   = "PT3H"
  })
})
             
$JitPolicyArr = @($JitPolicy)
              
Set-AzJitNetworkAccessPolicy -Kind "Basic" -Location $(location) -Name "default" -ResourceGroupName $(resource_group_name) -VirtualMachine $JitPolicyArr
SCRIPT
  identity {
    type = "UserAssigned"
    id = azurerm_managed_identity.example.id
  }
}

References

• #0000

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.