terraform-provider-azuread VS Fail2Ban

There are different Terraform Providers that enable Terraform to interact with Microsoft Azure. The most common one are Azure Stack, AzureDevops, AzureRM, AzAPI and AzureAD.. In this tutorial, we use the AzureRM Terraform Provider. Let's create a Terraform file for the AzureRM Terraform Provider.

It can be for anything. Here is the provider for Azure Active Directory. It looks like it has over a million downloads this week alone so someone is using it..

Since the provider doesnt currently support licensing on [users directly](https://github.com/hashicorp/terraform-provider-azuread/issues/745) i think the only other option is to create a group that maintains specific licenses for user-members... however, that seems to be pay-walled behind Business Premium or azure ad p1

Not officially supported yet: https://github.com/hashicorp/terraform-provider-azuread/issues/68

The support for privileged identity management in Terraform is very limited. One open issue that tracks it is https://github.com/hashicorp/terraform-provider-azuread/issues/547

Source: https://github.com/hashicorp/terraform-provider-azuread/blob/main/internal/services/directoryroles/directory_role_resource.go

I haven't particularly worked with this, but if you're looking for things to see before doing, I would recommend looking at the examples provided by Microsoft: https://docs.microsoft.com/en-us/azure/developer/terraform/ and read through the provider documentation to see the individual pieces: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs

now some things you need to think about: - cloud init - this will need to be secure so lock it down hard anything not needed an alternative OS to look at if you have the ability's is https://www.alpinelinux.org/ also as these devices are not that powerfull every extra agent / abstaction layer you add impacts performance need to look at low over head security https://www.crowdsec.net/ and https://github.com/fail2ban/fail2ban (if you call fail2ban security) - using certificates to authenticate ssh login

See https://github.com/fail2ban/fail2ban for beginner's guide, basically you set it up to monitor logfiles and it would act accordingly (plenty of built-in config to handle various daemons so you don't have to write yourself).

- Nginx & crowdsec/fail2ban if you are exposing your parts (services) to the public ( https://hub.docker.com/r/baudneo/nginx-proxy-manager, https://www.crowdsec.net, https://www.fail2ban.org )

— In /etc/fail2ban/action.d/cloudflare.conf I copied the file from https://github.com/fail2ban/fail2ban/blob/master/config/action.d/cloudflare.confand added my ‘cftoken’ and ‘cfuser’ on the bottom

https://github.com/fail2ban/fail2ban is a mature, easy to set up way to have some dynamic firewall rules that respond to attacks. There are more sophisticated options, but they are probably not worth the return on time investment for you.

You can create your own regexes for custom services: https://github.com/fail2ban/fail2ban/wiki/Developing-Regex-in-Fail2ban

Others seem to be (or were) experiencing this too: https://github.com/fail2ban/fail2ban/issues/3100