MYIP=$(curl -s https://checkip.amazonaws.com)/32

# AWS
aws ec2 run-instances --image-id <ami> --instance-type c7i.large \
  --key-name <key> --security-group-ids <sg> --subnet-id <subnet> \
  --associate-public-ip-address --metadata-options 'HttpTokens=required'

# GCE
gcloud compute instances create baseline --zone=us-east1-b \
  --machine-type=c4-standard-2 --image-family=debian-13 --image-project=debian-cloud

# Azure — --nsg-rule SSH opens 22 to the internet; narrow it afterwards
az vm create -g <rg> -n baseline --image <urn> --size Standard_D2s_v7 \
  --admin-username azureuser --ssh-key-values ~/.ssh/id_ed25519.pub --nsg-rule SSH
az network nsg rule update -g <rg> --nsg-name baselineNSG --name default-allow-ssh \
  --source-address-prefixes "$MYIP"