AzureのTerraformでVNetとLinux VMをコード化する方法｜azurermプロバイダーの設定からapply・destroy実践まで

この記事のポイント

・AzureのVNetとLinux VMはazurermプロバイダーで完全コード化できる
・terraform planで変更内容を事前確認してからapplyするのが鉄則
・terraform destroyで検証後のリソースを一括削除でき、コスト管理がしやすい
・本番ではtfstateをAzure Blob Storageのリモートバックエンドで管理する

# HashiCorpの署名キーを追加
sudo apt update && sudo apt install -y gnupg software-properties-common
wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | \
  sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null

# APTリポジトリを登録
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
  https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/hashicorp.list

# Terraformをインストール
sudo apt update && sudo apt install -y terraform

sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
sudo yum install -y terraform

$ terraform -version
Terraform v1.9.5
on linux_amd64

$ az login

[
  {
    "cloudName": "AzurePublicCloud",
    "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "isDefault": true,
    "name": "MySubscription",
    "state": "Enabled",
    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "user": {
      "name": "user@example.com",
      "type": "user"
    }
  }
]

$ az account show --query id -o tsv
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

$ mkdir azure-terraform-lab && cd azure-terraform-lab

azure-terraform-lab/
├── versions.tf         # プロバイダー・バージョン設定
├── variables.tf        # 変数定義
├── main.tf             # リソース定義（VNet・NSG・VM）
├── outputs.tf          # 出力値（IPアドレス等）
└── terraform.tfvars    # 変数の実際の値（Gitには含めない）

terraform {
  required_version = ">= 1.9.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = var.subscription_id
}

variable "subscription_id" {
  description = "Azure サブスクリプションID"
  type        = string
}

variable "location" {
  description = "Azureリージョン"
  type        = string
  default     = "japaneast"
}

variable "resource_group_name" {
  description = "リソースグループ名"
  type        = string
  default     = "rg-terraform-lab"
}

variable "vm_size" {
  description = "VMサイズ"
  type        = string
  default     = "Standard_B1ms"
}

variable "admin_username" {
  description = "VM管理者ユーザー名"
  type        = string
  default     = "azureuser"
}

variable "ssh_public_key" {
  description = "SSH公開鍵の内容（~/.ssh/id_rsa.pub）"
  type        = string
}

subscription_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
ssh_public_key  = "ssh-rsa AAAAB3Nz..."

# .gitignore
terraform.tfvars
.terraform/
*.tfstate
*.tfstate.backup

# ---- リソースグループ ----
resource "azurerm_resource_group" "main" {
  name     = var.resource_group_name
  location = var.location
}

# ---- 仮想ネットワーク（VNet）----
resource "azurerm_virtual_network" "main" {
  name                = "vnet-terraform-lab"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

# ---- サブネット ----
resource "azurerm_subnet" "main" {
  name                 = "subnet-main"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/24"]
}

# ---- ネットワークセキュリティグループ ----
resource "azurerm_network_security_group" "main" {
  name                = "nsg-terraform-lab"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  security_rule {
    name                       = "AllowSSH"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

# NSGをサブネットに関連付け
resource "azurerm_subnet_network_security_group_association" "main" {
  subnet_id                 = azurerm_subnet.main.id
  network_security_group_id = azurerm_network_security_group.main.id
}

# ---- パブリックIP ----
resource "azurerm_public_ip" "main" {
  name                = "pip-terraform-lab"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_network_interface" "main" {
  name                = "nic-terraform-lab"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  ip_configuration {
    name                          = "ipconfig1"
    subnet_id                     = azurerm_subnet.main.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.main.id
  }
}

resource "azurerm_linux_virtual_machine" "main" {
  name                = "vm-terraform-lab"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = var.vm_size
  admin_username      = var.admin_username

  network_interface_ids = [
    azurerm_network_interface.main.id,
  ]

  # パスワード認証を無効にしてSSH公開鍵認証のみ許可
  disable_password_authentication = true

  admin_ssh_key {
    username   = var.admin_username
    public_key = var.ssh_public_key
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "ubuntu-24_04-lts"
    sku       = "server"
    version   = "latest"
  }
}

output "public_ip_address" {
  description = "VMのパブリックIPアドレス"
  value       = azurerm_public_ip.main.ip_address
}

output "ssh_command" {
  description = "SSH接続コマンド"
  value       = "ssh -i ~/.ssh/id_rsa ${var.admin_username}@${azurerm_public_ip.main.ip_address}"
}

$ terraform init

Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/azurerm versions matching "~> 4.0"...
- Installing hashicorp/azurerm v4.14.0...
- Installed hashicorp/azurerm v4.14.0 (signed by HashiCorp)

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure.

$ terraform plan

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_resource_group.main will be created
  + resource "azurerm_resource_group" "main" {
      + location = "japaneast"
      + name     = "rg-terraform-lab"
    }

  # azurerm_virtual_network.main will be created
  + resource "azurerm_virtual_network" "main" {
      + address_space = [
          + "10.0.0.0/16",
        ]
      + location      = "japaneast"
      + name          = "vnet-terraform-lab"
    }

  # azurerm_linux_virtual_machine.main will be created
  + resource "azurerm_linux_virtual_machine" "main" {
      + admin_username = "azureuser"
      + location       = "japaneast"
      + name           = "vm-terraform-lab"
      + size           = "Standard_B1ms"
      ...
    }

  ...

Plan: 7 to add, 0 to change, 0 to destroy.

$ terraform apply

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

azurerm_resource_group.main: Creating...
azurerm_resource_group.main: Creation complete after 2s [id=/subscriptions/.../rg-terraform-lab]
azurerm_virtual_network.main: Creating...
azurerm_virtual_network.main: Creation complete after 4s
azurerm_subnet.main: Creating...
azurerm_subnet.main: Creation complete after 3s
azurerm_network_security_group.main: Creating...
azurerm_network_security_group.main: Creation complete after 3s
azurerm_public_ip.main: Creating...
azurerm_public_ip.main: Creation complete after 2s
azurerm_subnet_network_security_group_association.main: Creating...
azurerm_subnet_network_security_group_association.main: Creation complete after 2s
azurerm_network_interface.main: Creating...
azurerm_network_interface.main: Creation complete after 2s
azurerm_linux_virtual_machine.main: Creating...
azurerm_linux_virtual_machine.main: Still creating... [1m0s elapsed]
azurerm_linux_virtual_machine.main: Creation complete after 1m28s

Apply complete! Resources: 7 added, 0 changed, 0 destroyed.

Outputs:

public_ip_address = "52.185.123.45"
ssh_command = "ssh -i ~/.ssh/id_rsa azureuser@52.185.123.45"

$ ssh -i ~/.ssh/id_rsa azureuser@52.185.123.45

Welcome to Ubuntu 24.04 LTS (GNU/Linux 6.8.0-1019-azure x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

Last login: Sun Aug 24 04:20:10 2026 from 203.0.113.1
azureuser@vm-terraform-lab:~$

$ terraform destroy

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

azurerm_linux_virtual_machine.main: Destroying...
azurerm_linux_virtual_machine.main: Still destroying... [30s elapsed]
azurerm_linux_virtual_machine.main: Destruction complete after 58s
azurerm_network_interface.main: Destroying...
azurerm_subnet_network_security_group_association.main: Destroying...
...
azurerm_resource_group.main: Destruction complete after 7s

Destroy complete! Resources: 7 destroyed.

$ az group show --name rg-terraform-lab
ResourceNotFoundError: (ResourceGroupNotFound) ...

# ステート管理用のリソースグループとストレージアカウントを作成
az group create --name rg-tfstate --location japaneast

az storage account create \
  --resource-group rg-tfstate \
  --name satfstate$(openssl rand -hex 4) \
  --sku Standard_LRS \
  --allow-blob-public-access false

az storage container create \
  --name tfstate \
  --account-name satfstateXXXX

terraform {
  required_version = ">= 1.9.0"

  backend "azurerm" {
    resource_group_name  = "rg-tfstate"
    storage_account_name = "satfstateXXXX"
    container_name       = "tfstate"
    key                  = "terraform-lab.tfstate"
  }

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

Error: The `subscription_id` was not found in the Azure CLI credentials

$ az network nsg show \
    --resource-group rg-terraform-lab \
    --name nsg-terraform-lab \
    --query "securityRules[].{name:name,priority:priority,access:access,destPort:destinationPortRange}" \
    --output table

Name      Priority    Access    DestPort
--------  ----------  --------  ----------
AllowSSH  1001        Allow     22

Error: Code="InvalidParameter" Message="The value of parameter imageReference is invalid"

$ az vm image list \
    --publisher Canonical \
    --offer ubuntu-24_04-lts \
    --sku server \
    --all \
    --query "[0].{publisher:publisher,offer:offer,sku:sku,version:version}" \
    --output table

Publisher    Offer              Sku     Version
-----------  -----------------  ------  ----------
Canonical    ubuntu-24_04-lts   server  24.04.202408140

Error: Error acquiring the state lock