如何配置Packer在Azure白名单可用性集中创建临时VM制作镜像？

Great question—this is a common scenario when dealing with strict Azure governance and Packer image builds. Let’s break down how to get your Packer temporary VMs into that whitelisted availability set, plus a few other options to cover your bases.

This is the most direct approach. Packer's Azure ARM builder natively supports associating temporary VMs with an existing availability set via the availability_set_id parameter. You just need to point it to the resource ID of your whitelisted availability set.

Example configuration (HCL):

source "azure-arm" "enterprise_image" {
  client_id       = var.azure_client_id
  client_secret   = var.azure_client_secret
  tenant_id       = var.azure_tenant_id
  subscription_id = var.azure_subscription_id

  os_type         = "Linux"
  image_publisher = "Canonical"
  image_offer     = "0001-com-ubuntu-server-jammy"
  image_sku       = "22_04-lts"

  location        = "eastus"
  vm_size         = "Standard_D2s_v3"

  // Critical line: Bind temporary VM to your whitelisted availability set
  availability_set_id = "/subscriptions/your-subscription-id/resourceGroups/your-as-resource-group/providers/Microsoft.Compute/availabilitySets/your-whitelisted-availability-set"
}

build {
  sources = ["source.azure-arm.enterprise_image"]
}

Key notes:

• Ensure the availability set and temporary VM are in the same Azure region (cross-region associations aren't allowed).
• Verify the service principal (SPN) used by Packer has Microsoft.Compute/availabilitySets/read and Microsoft.Compute/virtualMachines/write permissions on the target availability set.

If you need to reuse configurations across different subscriptions or environments, hardcoding the availability set ID isn't ideal. Use Packer's azurearm_availability_set data source to dynamically pull the ID instead:

// Fetch the whitelisted availability set dynamically
data "azurearm_availability_set" "whitelisted_as" {
  name                = "your-whitelisted-availability-set"
  resource_group_name = "your-as-resource-group"
  subscription_id     = var.azure_subscription_id
}

source "azure-arm" "enterprise_image" {
  // Base configuration omitted for brevity...

  // Reference the dynamically fetched ID
  availability_set_id = data.azurearm_availability_set.whitelisted_as.id
}

Your thought to deploy the temporary VM into the same resource group as the availability set won't automatically associate it with the set. Resource groups are just logical containers—VMs only join an availability set when you explicitly configure the association via availability_set_id. Same-resource-group placement doesn't create this link.

For extra guardrails, pair Packer configurations with an Azure Policy to block any VM (including Packer's temporary ones) that isn't linked to your whitelisted availability set:

• Create a custom policy rule that checks for the presence of your target availability set ID on VMs.
• Assign the policy to your subscription or resource group to enforce compliance automatically.

After configuring, confirm the temporary VM is correctly associated:

1. Check Packer's build logs—you'll see a line referencing the linked availability set ID during VM creation.
2. In the Azure Portal, locate the temporary resource group (default naming format: packer-XXXXXX), then view the VM's "Availability set" property to confirm it matches your whitelisted set.

内容的提问来源于stack exchange，提问作者tushar_sappal