terraform-module-vm-bootstrap

A Terraform module for bootstrapping Linux or Windows Virtual Machines or Virtual Machine Scale Sets via supported agents and/custom scripts.

Supported Agents:

• Azure Monitor
• Dynatrace OneAgent
• Splunk Universal Forwarder
• Tenable Nessus Agent
• Run Command
• Microsoft Antimalware

Outdated Links

If the tenable install is failing please check that the download link has not expired as the link changes often. https://www.tenable.com/downloads

Requirements

A virtual machine or virtual machine scale set.

Providers

Name	Version
azurerm	n/a
azurerm.cnp	n/a
azurerm.soc	n/a

Resources

Name	Type
azurerm_virtual_machine_extension.azure_monitor	resource
azurerm_virtual_machine_extension.azure_vm_run_command	resource
azurerm_virtual_machine_extension.custom_script	resource
azurerm_virtual_machine_extension.dynatrace_oneagent	resource
azurerm_virtual_machine_extension.endpoint_protection	resource
azurerm_virtual_machine_scale_set_extension.azure_monitor	resource
azurerm_virtual_machine_scale_set_extension.azure_vmss_run_command	resource
azurerm_virtual_machine_scale_set_extension.custom_script	resource
azurerm_virtual_machine_scale_set_extension.dynatrace_oneagent	resource
azurerm_virtual_machine_scale_set_extension.endpoint_protection	resource
azurerm_key_vault.cnp_vault	data source
azurerm_key_vault.soc_vault	data source
azurerm_key_vault_secret.nessus_agent_key	data source
azurerm_key_vault_secret.splunk_pass4symmkey	data source
azurerm_key_vault_secret.splunk_password	data source
azurerm_key_vault_secret.splunk_username	data source
azurerm_key_vault_secret.token	data source

Inputs

Name	Description	Type	Default	Required
additional_script_mi_id	This variable will be used to pass Managed Identity ID when the additional script has been used	any	null	no
additional_script_name	Additional script name when using script additional_script_uri.	any	null	no
additional_script_path	Path to additional script.	any	null	no
additional_script_uri	Uri download link to additional script	any	null	no
antimalwareenabled	Enable AntiMalware Protection	string	true	no
azure_monitor_auto_upgrade_minor_version	Specifies if the platform deploys the latest minor version Azure Monitor update to the type_handler_version specified.	bool	true	no
azure_monitor_protected_settings	The protected_settings passed to the Azure Monitor extension, like settings, these are specified as a JSON object in a string.	string	null	no
azure_monitor_settings	The settings passed to the Azure Monitor extension, these are specified as a JSON object in a string.	string	null	no
azure_monitor_type_handler_version	Version of Azure Monitor - To find: az vm extension image list --location uksouth -p Microsoft.Azure.Monitor -o table	string	"1.9"	no
cnp_vault_rg	The name of the resource group where the CNP Key Vault is located.	string	null	no
common_tags	Common Tags	map(string)	null	no
custom_script_extension_name	Custom script extension name label.	string	"HMCTSVMBootstrap"	no
custom_script_type_handler_version	Type handler version number	string	"2.1"	no
custom_script_type_handler_version_windows	Type handler version number for Windows VMs	string	"1.9"	no
dynatrace_auto_upgrade_minor_version	Specifies if the platform deploys the latest minor version Dynatrace OneAgent update to the type_handler_version specified.	bool	true	no
dynatrace_hostgroup	Define the hostgroup to which the VM belongs.	string	null	no
dynatrace_network_zone	the network zone the oneagent is attached to i.e azure.cft	string	"azure.cft"	no
dynatrace_server	The server URL, if you want to configure an alternative communication endpoint.	string	null	no
dynatrace_tenant_id	The tenant ID of your Dynatrace environment.	string	""	no
dynatrace_token	The API token of your Dynatrace environment.	string	""	no
dynatrace_type_handler_version	Version of Dynatrace OneAgent - To find: az vm extension image list --location uksouth -p dynatrace.ruxit -o table	string	"2.200"	no
endpoint_protection_handler_version	Enable Antimalware Protection.	string	"1.6"	no
endpoint_protection_upgrade_minor_version	Specifies if the platform deploys the latest minor version Endpoint Protection update to the type_handler_version specified.	bool	true	no
env	Environment name.	string	n/a	yes
install_azure_monitor	Install Azure Monitor Agent.	bool	true	no
install_dynatrace_oneagent	Install Dynatrace OneAgent.	bool	true	no
install_endpoint_protection	Install Endpoint Protection.	bool	true	no
install_nessus_agent	Install Nessus Agent.	bool	true	no
install_splunk_uf	Install Splunk UF.	bool	true	no
nessus_groups	Nessus group name.	string	"Platform-Operation-Bastions"	no
nessus_key	Nessus linking key - read input from keyvault.	string	null	no
nessus_server	Nessus server endpoint - read input from keyvault.	string	""	no
os_type	Windows or Linux.	string	"Linux"	no
rc_auto_upgrade_minor_version	n/a	bool	false	no
rc_os_sku	n/a	any	null	no
rc_script_file	A path to a local file for the script	any	null	no
realtimeprotectionenabled	Enable Realtime Protection	string	true	no
run_command	n/a	bool	false	no
run_command_settings	The settings passed to the Run Command extension, these are specified as a JSON object in a string.	string	null	no
run_command_type_handler_version	Type handler version number	string	"1.0"	no
run_command_type_handler_version_windows	Type handler version number for Windows VMs	string	"1.1"	no
scheduledscansettings	Enable Scanning	map(string)	{ "day": "7", "isEnabled": "true", "scanType": "Quick", "time": "120" }	no
soc_vault_name	The name of the SOC Key Vault.	string	"soc-prod"	no
soc_vault_rg	The name of the resource group where the SOC Key Vault is located.	string	"soc-core-infra-prod-rg"	no
splunk_group	Splunk universal forwarder global target group.	string	"hmcts_forwarders"	no
splunk_pass4symmkey	Splunk universal forwarder communication security key - read input from keyvault.	string	null	no
splunk_password	Splunk universal forwarder local admin password - read input from keyvault.	string	null	no
splunk_username	Splunk universal forwarder local admin username - read input from keyvault.	string	null	no
virtual_machine_id	Virtual machine resource id.	string	null	no
virtual_machine_scale_set_id	Virtual machine scale set resource id.	string	null	no
virtual_machine_type	vm or vmss.	string	n/a	yes