это сработало для меня.
resource "azurerm_virtual_machine_extension" "software" {
name = "install-software"
resource_group_name = azurerm_resource_group.azrg.name
virtual_machine_id = azurerm_virtual_machine.vm.id
publisher = "Microsoft.Compute"
type = "CustomScriptExtension"
type_handler_version = "1.9"
protected_settings = <<SETTINGS
{
"commandToExecute": "powershell -command \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${base64encode(data.template_file.tf.rendered)}')) | Out-File -filepath install.ps1\" && powershell -ExecutionPolicy Unrestricted -File install.ps1"
}
SETTINGS
}
data "template_file" "tf" {
template = "${file("install.ps1")}"
}