如何为azurerm_windows_virtual_machine关联SSH密钥或账号密码？

首先明确：Azure Windows虚拟机默认不启用SSH，需先确保系统支持OpenSSH Server（如Windows Server 2019/2022默认可选安装，Windows 10/11专业版/企业版也支持）。Terraform的azurerm_windows_virtual_machine资源没有Linux那样的admin_ssh_key直接配置块，需通过以下方式实现SSH访问配置：

1. 基础管理员账户配置 #

Windows虚拟机必须设置管理员用户名和密码（本地账户），这是Terraform配置的必填项：

resource "azurerm_windows_virtual_machine" "example" {
  name                = "example-win-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_D2s_v3"
  admin_username      = "adminuser"
  admin_password      = "ComplexPassw0rd!" # 生产环境请用变量或密钥管理工具存储

  # 其他必填配置：network_interface_ids、storage_os_disk等...
}

2. 启用并配置SSH访问 #

要让Windows VM支持SSH，需安装OpenSSH Server并配置公钥认证，推荐用Terraform虚拟机扩展实现：

方法一：自定义脚本扩展安装OpenSSH并导入公钥 #

resource "azurerm_virtual_machine_extension" "win_ssh_setup" {
  name                 = "win-ssh-setup"
  virtual_machine_id   = azurerm_windows_virtual_machine.example.id
  publisher            = "Microsoft.Compute"
  type                 = "CustomScriptExtension"
  type_handler_version = "1.10"

  settings = jsonencode({
    commandToExecute = <<-EOT
      # 安装OpenSSH Server
      Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
      # 启动服务并设置开机自启
      Start-Service sshd
      Set-Service -Name sshd -StartupType 'Automatic'
      # 配置管理员公钥
      $sshDir = Join-Path $env:ProgramData "ssh"
      $authKeysFile = Join-Path $sshDir "administrators_authorized_keys"
      New-Item -Path $authKeysFile -Force
      Add-Content -Path $authKeysFile -Value '${file("~/.ssh/id_rsa.pub")}'
      # 设置文件权限（SSH要求严格权限）
      icacls $authKeysFile /inheritance:r
      icacls $authKeysFile /grant "NT AUTHORITY\SYSTEM:(F)"
      icacls $authKeysFile /grant "BUILTIN\Administrators:(F)"
      Restart-Service sshd
    EOT
  })
}

方法二：使用Azure官方OpenSSH扩展（更简洁） #

Azure提供专门的OpenSSH扩展，无需编写复杂脚本：

resource "azurerm_virtual_machine_extension" "win_ssh" {
  name                 = "OpenSSH-Win32"
  virtual_machine_id   = azurerm_windows_virtual_machine.example.id
  publisher            = "Microsoft.OpenSSH"
  type                 = "OpenSSH-Win32"
  type_handler_version = "1.0"

  settings = jsonencode({
    "ssh_public_keys" = [
      {
        "path"     = "C:/ProgramData/ssh/administrators_authorized_keys"
        "key_data" = file("~/.ssh/id_rsa.pub")
      }
    ]
  })
}

3. 关键注意事项 #

• 必须在虚拟机的网络安全组（NSG）开放22端口，允许SSH流量：

resource "azurerm_network_security_rule" "allow_ssh" {
  name                        = "AllowSSH"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "22"
  source_address_prefix       = "*" # 生产环境请限制为特定IP段
  destination_address_prefix  = "*"
  network_security_group_name = azurerm_network_security_group.example.name
  resource_group_name         = azurerm_resource_group.example.name
}

• 生产环境禁止硬编码密码或密钥，建议用Terraform变量、Azure Key Vault或环境变量管理敏感数据。
• 若仅需密钥登录，可在自定义脚本中修改sshd_config，设置PasswordAuthentication no禁用密码登录。

内容的提问来源于stack exchange，提问作者JSecurity