main.tf

variable location  { default = "Central US" }
variable username { default = "test" }
variable password { default = "P@ss!admin123" }

provider "azure" {
  # Can alternatively set AZURE_SETTINGS_FILE env var
  settings_file = "${file("credentials.publishsettings")}"
}

resource "azure_storage_service" "vmstorage" {
  name = "${var.username}"
  location = "${var.location}"
  account_type = "Standard_LRS"
}

resource "azure_security_group" "web" {
  name = "web"
  location = "${var.location}"
}

resource "azure_security_group_rule" "winrm" {
  name = "winrm"
  security_group_names = ["${azure_security_group.web.name}"]
  type = "Inbound"
  action = "Allow"
  priority = 201
  source_address_prefix = "70.197.244.146/32"
  source_port_range = "*"
  destination_address_prefix = "10.0.1.0/24"
  destination_port_range = "*"
  protocol = "TCP"
}

resource "azure_virtual_network" "network" {
  name = "${var.username}-network"
  address_space = ["10.0.0.0/16"]
  location = "${var.location}"

  subnet {
    name = "websubnet"
    address_prefix = "10.0.1.0/24"
    security_group = "${azure_security_group.web.name}"
  }
}

resource "azure_hosted_service" "web" {
  name = "${var.username}-web"
  location = "${var.location}"
  ephemeral_contents = false
  label = "tf-ws-01"
}

resource "azure_instance" "web" {
  name = "web"
  hosted_service_name = "${azure_hosted_service.web.name}"
  image = "Windows Server 2012 R2 Datacenter, July 2015"
  size = "Basic_A1"
  storage_service_name = "${azure_storage_service.vmstorage.name}"
  location = "${var.location}"
  username = "${var.username}"
  password = "${var.password}"
  time_zone = "America/Los_Angeles"
  subnet = "websubnet"
  virtual_network = "${azure_virtual_network.network.name}"

  endpoint {
    name = "RDP"
    protocol = "tcp"
    public_port = 3389
    private_port = 3389
  }

  endpoint {
    name = "WinRM"
    protocol = "tcp"
    public_port = 5985
    private_port = 5985
  }

  endpoint {
    name = "WinRM Secure"
    protocol = "tcp"
    public_port = 5986
    private_port = 5986
  }

  provisioner "remote-exec" {
    connection {
      type     = "winrm"
      user     = "${var.username}"
      password = "${var.password}"
      host     = "${self.ip_address}"
      port     = 5986
      https    = true
      insecure = false
      timeout      = "5m"
      # cacert       = ""
    }

    inline = [ <<COMMANDS
Install-WindowsFeature Web-Server
Install-WindowsFeature Web-Mgmt-Tools
Install-WindowsFeature Web-App-Dev -IncludeAllSubFeature

$port1 = New-Object -ComObject HNetCfg.FWOpenPort

$port1.Port = 80

$port1.Name = 'HttpPort' # name of Port

$port1.Enabled = $true

$fwMgr = New-Object -ComObject HNetCfg.FwMgr

$profiledomain=$fwMgr.LocalPolicy.GetProfileByType(0)

$profiledomain.GloballyOpenPorts.Add($port1)
COMMANDS ]
  }
}