Why does WinRM fail with Terraform?

Question

I am trying to copy files to virtual machines deployed to Azure via Terraform. No matter what I try, it constantly fails with WinRM

I have verified port 5895 is open to my IP address in Azure.

I am also using a user with local administrative privileges on the virtual machine. What else is needed to make this work? Below is my Terraform file. I have also tried doing this with Ansible, but that also fails.

          resource "azurerm_network_interface" "workstation" {
        count = length(local.domain.workstations)

        name                = "${var.prefix}-wks-${count.index}-nic"
        location            = azurerm_resource_group.main.location
        resource_group_name = azurerm_resource_group.main.name

        ip_configuration {
          name                          = "static"
          subnet_id                     = azurerm_subnet.workstations.id
          private_ip_address_allocation = "Static"
          private_ip_address            = cidrhost(var.workstations_subnet_cidr, 10 + count.index)
          public_ip_address_id          = azurerm_public_ip.workstation[count.index].id
        }
      }

      resource "azurerm_network_interface_security_group_association" "workstation" {
        count = length(local.domain.workstations)

        network_interface_id      = azurerm_network_interface.workstation[count.index].id
        network_security_group_id = azurerm_network_security_group.windows.id
      }
      resource "azurerm_virtual_machine" "workstation" {
        count = length(local.domain.workstations)

        name                  = local.domain.workstations[count.index].name
        location              = azurerm_resource_group.main.location
        resource_group_name   = azurerm_resource_group.main.name
        network_interface_ids = [azurerm_network_interface.workstation[count.index].id]
        vm_size               = var.workstations_vm_size

      
        delete_os_disk_on_termination = true
        delete_data_disks_on_termination = true

        storage_image_reference {
          publisher = "MicrosoftWindowsDesktop"
          offer     = "Windows-10"
          sku     = "win10-22h2-pron-g2"
          version = "latest"
        }
        storage_os_disk {
          name              = "wks-${count.index}-os-disk"
          caching           = "ReadWrite"
          create_option     = "FromImage"
          managed_disk_type = "Standard_LRS"
        }
        os_profile {
          computer_name  = local.domain.workstations[count.index].name
          admin_username = local.domain.default_local_admin.username
          admin_password = local.secret
        }
        os_profile_windows_config {
          enable_automatic_upgrades = false
          timezone                  = "Central European Standard Time"
          winrm {
            protocol = "HTTP"
          }
        }

        tags = {
          kind = "workstation"
        }
      }


      resource "null_resource" "provision_workstation_once_dc_has_been_created" {
        provisioner "local-exec" {
          working_dir = "${path.root}/../ansible"
          command     = "/bin/bash -c 'source venv/bin/activate && ansible-playbook workstations.yml -v'"
        }

        depends_on = [
          azurerm_virtual_machine.dc,
          azurerm_virtual_machine.workstation
        ]
      }

      resource "null_resource" "copy_files" {
        for_each = { for idx, nic in azurerm_network_interface.workstation : idx => nic.private_ip_address }


        provisioner "file" {
          source      = "/home/user_name/files/setup.exe"
          destination = "\\\\${each.value}\\C$\\users\\public"
        }

        connection {
          type     = "winrm"
          user     = "localadmin"
          password = "Super_Secret_Password"
          host     = "${each.value}"
          timeout     = "5m"
          insecure    = true
        }

          depends_on = [
            azurerm_virtual_machine.dc,
            azurerm_virtual_machine.workstation,
            azurerm_network_interface.workstation
        ]
      }

Answer 1

I am trying to copy files to virtual machines deployed to Azure via Terraform. No matter what I try, it constantly fails with WinRM

I agree with Helder Sepulveda suggestion to use the azurerm_virtual_machine_extension.

Here is the updated script to deploy Azure VMs and copy the files. You can use a for-each block to initiate the same process for each VM.

    provider "azurerm" {
      features {}
    }
    
    resource "azurerm_resource_group" "example" {
      name     = "vm-resources1"
      location = "West Europe"
    }
    
    resource "azurerm_virtual_network" "example" {
      name                = "vm-network"
      address_space       = ["10.0.0.0/16"]
      location            = azurerm_resource_group.example.location
      resource_group_name = azurerm_resource_group.example.name
    }
    
    resource "azurerm_subnet" "example" {
      name                 = "internal"
      resource_group_name  = azurerm_resource_group.example.name
      virtual_network_name = azurerm_virtual_network.example.name
      address_prefixes     = ["10.0.2.0/24"]
    }
    
    resource "azurerm_public_ip" "my_terraform_public_ip" {
      name                = "vm-public-ip"
      location            = azurerm_resource_group.example.location
      resource_group_name = azurerm_resource_group.example.name
      allocation_method   = "Dynamic"
    }
    resource "azurerm_network_interface" "my_terraform_nic" {
      name                = "vm-nic"
      location            = azurerm_resource_group.example.location
      resource_group_name = azurerm_resource_group.example.name
    
      ip_configuration {
        name                          = "internal"
        subnet_id                     = azurerm_subnet.example.id
        private_ip_address_allocation = "Dynamic"
        public_ip_address_id          = azurerm_public_ip.my_terraform_public_ip.id
      }
    }
    
    resource "azurerm_network_security_group" "my_terraform_nsg" {
      name                = "vm-nsg"
      location            = azurerm_resource_group.example.location
      resource_group_name = azurerm_resource_group.example.name
    
      security_rule {
        name                       = "Allow-all"
        priority                   = 100
        direction                  = "Inbound"
        access                     = "Allow"
        protocol                   = "*"
        source_port_range          = "*"
        destination_port_range     = "*"
        source_address_prefix      = "*"
        destination_address_prefix = "*"
      }
    }
    
    resource "azurerm_network_interface_security_group_association" "example" {
      network_interface_id      = azurerm_network_interface.my_terraform_nic.id
      network_security_group_id = azurerm_network_security_group.my_terraform_nsg.id
    }
    
    resource "azurerm_windows_virtual_machine" "example" {
      name                = "venkat-machine"
      resource_group_name = azurerm_resource_group.example.name
      location            = azurerm_resource_group.example.location
      size                = "Standard_F2"
      admin_username      = "adminuser"
      admin_password      = "P@$$w0rd1234!"
      network_interface_ids = [
        azurerm_network_interface.my_terraform_nic.id,
      ]
    
      os_disk {
        caching              = "ReadWrite"
        storage_account_type = "Standard_LRS"
      }
    
      source_image_reference {
        publisher = "MicrosoftWindowsServer"
        offer     = "WindowsServer"
        sku       = "2016-Datacenter"
        version   = "latest"
      }
    }
    
    resource "azurerm_virtual_machine_extension" "install_7zip" {
      name                 = "copy-files-to-vm"
      virtual_machine_id   = azurerm_windows_virtual_machine.example.id
      publisher            = "Microsoft.Compute"
      type                 = "CustomScriptExtension"
      type_handler_version = "1.10"
    
      settings = <<SETTINGS
        {
          "commandToExecute": "powershell.exe -ExecutionPolicy Bypass -Command \"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://vktestsb.blob.core.windows.net/demo/7z2301-x64.exe' -OutFile 'C:\\Packages\\7z2301-x64.exe'\""
        }
    SETTINGS
    }

Terraform apply:

After running the script , the file has been copied to VM successfully.