Research Terraform resilience for Azure: region, VM size, and subscription restrictions

[madebygps]

Parent Issue

Sub-issue of #95

Goal

Research what options exist to make the Azure Terraform deployment more resilient for users with restricted subscriptions (e.g., student subscriptions, limited regions, VM size quotas, spending caps).

Research Areas

• What Azure regions are commonly restricted or unavailable for student/free-tier subscriptions?
• Which VM sizes are most universally available (e.g., Standard_B1s vs Standard_DS1_v2)?
• How do Azure subscription types (Pay-As-You-Go, Student, Visual Studio, etc.) affect available resources?
• Can we add Terraform validation or pre-flight checks to surface quota/region issues early?
• Are there Azure-specific Terraform patterns for graceful fallback (e.g., trying multiple regions)?

Deliverables

• Document findings in this issue
• Recommend whether changes are worth implementing for Azure
• If yes, propose specific Terraform variable defaults, validation rules, or fallback logic

Notes

Azure student subscriptions are particularly common for this project's audience. Even if no changes are needed, document why.

[github-actions]

Thanks for reporting this issue! 👋

Before we proceed, please check our FAQ page.

If your issue isn't addressed in the FAQ, please provide:

• Steps to reproduce
• Expected behavior
• Actual behavior
• Any relevant error messages
• Screenshots, if applicable

This will help us investigate and resolve your issue more quickly.

[rishabkumar7]

Findings and changes for Azure. Implementation is in #136.

Findings

• Regions: Azure has no zone selection in this lab, so the AZ problems fixed for AWS (Research Terraform resilience for AWS: region, instance type, and subscription restrictions #98) and GCP (Research Terraform resilience for GCP: region, machine type, and account restrictions #97) don't apply. Azure for Students subscriptions are often limited to a set of allowed regions by policy (RequestDisallowedByAzure), and East US isn't always one of them.
• VM sizes: the most common Student failure is SkuNotAvailable for Standard_B1s in eastus, a per-subscription restriction (NotAvailableForSubscription) that only surfaced mid-apply. x64 sizes small enough for the lab: Standard_B1s, Standard_B1ms, Standard_B2s, Standard_B2ats_v2. Arm64 sizes such as Standard_B2pts_v2 are cheap and available but can't boot the lab's x64 image.
• Subscription types: Student subscriptions add region policy, size restrictions, and a credit limit that disables the subscription when used up (ReadOnlyDisabledSubscription). Pay-As-You-Go mostly hits regional capacity and vCPU quota, which were already documented.
• Pre-flight checks: azurerm has no data source for SKU availability. Microsoft's azapi provider can query Microsoft.Compute/skus, which takes a few seconds at plan time.
• Fallback patterns: automatic multi-region fallback isn't practical in Terraform (the resource group, network, and VM must share a region chosen up front). Failing early with a clear message and documented alternatives is the workable option.
• Existing workaround: the README linked an external Spot-instance guide recommending Standard_DC1s_v2, which is no longer listed in eastus, eastus2, westus2, or centralus.
• Already solid: the bootstrap waits for cloud-init and the dpkg lock, Terraform waits on the Custom Script Extension, and resource provider registration is handled.

Recommendation

Worth implementing, and done in #136:

• Plan-time check (via azapi) that the VM size is offered in the region, not restricted for the subscription, and x64.
• dpkg lock timeout raised to 300s to match AWS and GCP.
• TROUBLESHOOTING.md: plan-time messages and working x64 sizes, plus new Azure for Students errors and Resource group already exists sections.
• README Student note points to the in-repo section instead of the external guide.

Testing

• Plan-level: defaults and East US 2 plan normally; a restricted size, an Arm64 size, and a nonexistent size each stop at plan with a clear message.
• Full release-mode deploy: setup completed, password SSH works, and the CTF test suite passed 28/28. The apt lock race didn't occur on that boot.
• Not tested on a real Azure for Students subscription; the restriction check was exercised with a size that has the same NotAvailableForSubscription restriction on a regular subscription.

With #97 and #98 closed, this is the last sub-issue of #95.