# Terraform and Ansible Automate First Boot

**URL:** <https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361>\
**Category:** Get Help\
**Tags:** azure, terraform, ansible, awx\
**Created:** [May 2, 2025, 1:06pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361 "2025-05-02T13:06:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![wes](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@wes](https://forum.ansible.com/u/wes)\
**Post date:** [May 2, 2025, 1:06pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/1 "2025-05-02T13:06:43Z")

</div>

I am using Terraform and Ansible. With Azure VMs. I am just using ansible without AWX/Tower and hoping to not use those as it’s not a very big environment. For the ansible inventory we are using Azure dynamic inventory plugin for ansible.

What I want to do is have terraform provision the azure vms, then somehow copy our ansible vault password to the vm (securely), install ansible, clone our ansible repo, and have the server do an `ansible-pull` on the first boot so it gets it’s initial configuration automatically.

Does anyone have any recommendations on how to do this?

---

<div class="post-metadata">

**Author:** ![wayt](https://avatars.discourse-cdn.com/v4/letter/w/3be4f8/32.png) [@wayt](https://forum.ansible.com/u/wayt)\
**Post date:** [May 2, 2025, 4:35pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/2 "2025-05-02T16:35:32Z")

</div>

Entitle the VM to get the relevant secret from Azure Key Vault and combine that with (assuming these are Linux VMs): [Install Ansible - cloud-init 25.1.2 documentation](https://docs.cloud-init.io/en/latest/reference/yaml_examples/ansible.html)

---

<div class="post-metadata">

**Author:** ![wes](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@wes](https://forum.ansible.com/u/wes)\
**Post date:** [May 2, 2025, 5:08pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/3 "2025-05-02T17:08:08Z")

</div>

Thanks @wayt . Yes. Linux VMs. This is exactly what I was looking for.

---

<div class="post-metadata">

**Author:** ![wes](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@wes](https://forum.ansible.com/u/wes)\
**Post date:** [May 2, 2025, 7:19pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/4 "2025-05-02T19:19:11Z")

</div>

Can you clarify a bit more about the process of “Entitle the VM to get the relevant secret from Azure Key Vault”. Are there any instructions online for that?

---

<div class="post-metadata">

**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\
**Post date:** [May 2, 2025, 9:58pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/5 "2025-05-02T21:58:21Z")

</div>

You marked it as a solution without knowing what he was telling you to do…?

---

<div class="post-metadata">

**Author:** ![wayt](https://avatars.discourse-cdn.com/v4/letter/w/3be4f8/32.png) [@wayt](https://forum.ansible.com/u/wayt)\
**Post date:** [May 2, 2025, 10:32pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/6 "2025-05-02T22:32:05Z")

</div>

Assign a managed identity to the VM and grant that identity/ VM access to the key vault.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [June 1, 2025, 10:32pm UTC](https://forum.ansible.com/t/terraform-and-ansible-automate-first-boot/42361/7 "2025-06-01T22:32:18Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.