Skip to content

Commit aac920d

Browse files
grayzugrayzu
authored
Merge pull request microsoft#102 from myc2h6o/confidential_vm
Add examples for confidential VM, VMSS and OS Disk
2 parents 45c2609 + e11e21b commit aac920d

File tree

13 files changed

+387
-0
lines changed

13 files changed

+387
-0
lines changed

‎quickstart/201-confidential-os-disk/main.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
data "azurerm_platform_image" "example" {
2+
location = var.location
3+
publisher = "MicrosoftWindowsServer"
4+
offer = "windows-cvm"
5+
sku = "2022-datacenter-cvm"
6+
}
7+
8+
resource "azurerm_resource_group" "example" {
9+
name = "${var.name_prefix}-rg"
10+
location = var.location
11+
}
12+
13+
resource "azurerm_managed_disk" "example" {
14+
name = "${var.name_prefix}-disk"
15+
location = azurerm_resource_group.example.location
16+
resource_group_name = azurerm_resource_group.example.name
17+
storage_account_type = "Standard_LRS"
18+
create_option = "FromImage"
19+
image_reference_id = data.azurerm_platform_image.example.id
20+
os_type = "Windows"
21+
hyper_v_generation = "V2"
22+
23+
security_type = "ConfidentialVM_DiskEncryptedWithPlatformKey"
24+
}

‎quickstart/201-confidential-os-disk/providers.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">=1.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "~>3.8"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {}
14+
}

‎quickstart/201-confidential-os-disk/readme.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Azure confidential os disk
2+
3+
This template deploys an Azure confidential os disk encrypted by platform key.
4+
5+
## Resources
6+
7+
- [azurerm_managed_disk](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk)
8+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
9+
10+
## Variables
11+
12+
| Name | Description |
13+
|-|-|
14+
| `location` | (Required) Azure Region in which to deploy these resources.|
15+
| `name_prefix` | (Required) Prefix of the resource name.|
16+
17+
## Example
18+
19+
To see how to run this example, see [Create an Azure confidential os disk using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-confidential-os-disk).

‎quickstart/201-confidential-os-disk/variables.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "location" {
2+
type = string
3+
description = "Location where resources will be created"
4+
}
5+
6+
variable "name_prefix" {
7+
type = string
8+
description = "Prefix of the resource name"
9+
}

‎quickstart/201-confidential-vm/main.tf‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
resource "azurerm_resource_group" "example" {
2+
name = "${var.name_prefix}-rg"
3+
location = var.location
4+
}
5+
6+
// Key Vault and Disk Encryption Set
7+
data "azurerm_client_config" "current" {}
8+
9+
resource "azurerm_key_vault" "example" {
10+
name = "${var.name_prefix}-kv"
11+
location = azurerm_resource_group.example.location
12+
resource_group_name = azurerm_resource_group.example.name
13+
sku_name = "premium"
14+
tenant_id = data.azurerm_client_config.current.tenant_id
15+
enabled_for_disk_encryption = true
16+
purge_protection_enabled = true
17+
soft_delete_retention_days = 7
18+
}
19+
20+
resource "azurerm_key_vault_access_policy" "service-principal" {
21+
key_vault_id = azurerm_key_vault.example.id
22+
tenant_id = data.azurerm_client_config.current.tenant_id
23+
object_id = data.azurerm_client_config.current.object_id
24+
25+
key_permissions = [
26+
"Create",
27+
"Delete",
28+
"Get",
29+
"Purge",
30+
"Update",
31+
]
32+
33+
secret_permissions = [
34+
"Get",
35+
"Delete",
36+
"Set",
37+
]
38+
}
39+
40+
resource "azurerm_key_vault_key" "example" {
41+
name = "examplekey"
42+
key_vault_id = azurerm_key_vault.example.id
43+
key_type = "RSA-HSM"
44+
key_size = 2048
45+
46+
key_opts = [
47+
"decrypt",
48+
"encrypt",
49+
"sign",
50+
"unwrapKey",
51+
"verify",
52+
"wrapKey",
53+
]
54+
55+
depends_on = [azurerm_key_vault_access_policy.service-principal]
56+
}
57+
58+
resource "azurerm_disk_encryption_set" "example" {
59+
name = "${var.name_prefix}-des"
60+
resource_group_name = azurerm_resource_group.example.name
61+
location = azurerm_resource_group.example.location
62+
key_vault_key_id = azurerm_key_vault_key.example.id
63+
encryption_type = "ConfidentialVmEncryptedWithCustomerKey"
64+
65+
identity {
66+
type = "SystemAssigned"
67+
}
68+
}
69+
70+
resource "azurerm_key_vault_access_policy" "disk-encryption" {
71+
key_vault_id = azurerm_key_vault.example.id
72+
73+
key_permissions = [
74+
"Get",
75+
"WrapKey",
76+
"UnwrapKey",
77+
]
78+
79+
tenant_id = azurerm_disk_encryption_set.example.identity.0.tenant_id
80+
object_id = azurerm_disk_encryption_set.example.identity.0.principal_id
81+
}
82+
83+
// Virtual Machine
84+
resource "azurerm_virtual_network" "example" {
85+
name = "${var.name_prefix}-vnet"
86+
address_space = ["10.0.0.0/16"]
87+
location = azurerm_resource_group.example.location
88+
resource_group_name = azurerm_resource_group.example.name
89+
}
90+
91+
resource "azurerm_subnet" "example" {
92+
name = "${var.name_prefix}-subnet"
93+
resource_group_name = azurerm_resource_group.example.name
94+
virtual_network_name = azurerm_virtual_network.example.name
95+
address_prefixes = ["10.0.2.0/24"]
96+
}
97+
98+
resource "azurerm_network_interface" "example" {
99+
name = "${var.name_prefix}-nic"
100+
location = azurerm_resource_group.example.location
101+
resource_group_name = azurerm_resource_group.example.name
102+
103+
ip_configuration {
104+
name = "internal"
105+
subnet_id = azurerm_subnet.example.id
106+
private_ip_address_allocation = "Dynamic"
107+
}
108+
}
109+
110+
resource "azurerm_linux_virtual_machine" "test" {
111+
name = "${var.name_prefix}-vm"
112+
resource_group_name = azurerm_resource_group.example.name
113+
location = azurerm_resource_group.example.location
114+
115+
# Available sizes for Confidential VM can be found at: https://docs.microsoft.com/azure/confidential-computing/confidential-vm-overview
116+
size = "Standard_DC2as_v5"
117+
118+
admin_username = "azureuser"
119+
network_interface_ids = [
120+
azurerm_network_interface.example.id,
121+
]
122+
123+
admin_ssh_key {
124+
username = "azureuser"
125+
public_key = var.vm_public_key
126+
}
127+
128+
os_disk {
129+
caching = "ReadWrite"
130+
storage_account_type = "Standard_LRS"
131+
security_encryption_type = "DiskWithVMGuestState"
132+
secure_vm_disk_encryption_set_id = azurerm_disk_encryption_set.example.id
133+
}
134+
135+
source_image_reference {
136+
publisher = "Canonical"
137+
offer = "0001-com-ubuntu-confidential-vm-focal"
138+
sku = "20_04-lts-cvm"
139+
version = "latest"
140+
}
141+
142+
vtpm_enabled = true
143+
secure_boot_enabled = true
144+
145+
depends_on = [
146+
azurerm_key_vault_access_policy.disk-encryption,
147+
]
148+
}

‎quickstart/201-confidential-vm/providers.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
terraform {
2+
required_version = ">=1.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "~>3.8"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {
14+
key_vault {
15+
recover_soft_deleted_key_vaults = false
16+
purge_soft_delete_on_destroy = false
17+
purge_soft_deleted_keys_on_destroy = false
18+
}
19+
}
20+
}

‎quickstart/201-confidential-vm/readme.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Azure confidential virtual machine
2+
3+
This template deploys an Azure confidential virtual machine with disk encrypted by customer managed key.
4+
5+
## Resources
6+
7+
- [azurerm_disk_encryption_set](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/disk_encryption_set)
8+
- [azurerm_key_vault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault)
9+
- [azurerm_key_vault_access_policy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy)
10+
- [azurerm_key_vault_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key)
11+
- [azurerm_linux_virtual_machine](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine)
12+
- [azurerm_network_interface](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface)
13+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
14+
- [azurerm_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)
15+
- [azurerm_virtual_network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network)
16+
17+
## Variables
18+
19+
| Name | Description |
20+
|-|-|
21+
| `location` | (Required) Azure Region in which to deploy these resources.|
22+
| `name_prefix` | (Required) Prefix of the resource name.|
23+
| `vm_public_key` | (Required) Public key of the Virtual Machine.|
24+
25+
## Example
26+
27+
To see how to run this example, see [Create an Azure confidential virtual machine using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-confidential-vm).

‎quickstart/201-confidential-vm/variables.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
variable "location" {
2+
type = string
3+
description = "Location where resources will be created"
4+
}
5+
6+
variable "name_prefix" {
7+
type = string
8+
description = "Prefix of the resource name"
9+
}
10+
11+
variable "vm_public_key" {
12+
type = string
13+
description = "Public key of the Virtual Machine"
14+
}

‎quickstart/201-confidential-vmss/main.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
resource "azurerm_resource_group" "example" {
2+
name = "${var.name_prefix}-rg"
3+
location = var.location
4+
}
5+
6+
resource "azurerm_virtual_network" "example" {
7+
name = "${var.name_prefix}-vnet"
8+
address_space = ["10.0.0.0/16"]
9+
location = azurerm_resource_group.example.location
10+
resource_group_name = azurerm_resource_group.example.name
11+
}
12+
13+
resource "azurerm_subnet" "example" {
14+
name = "${var.name_prefix}-subnet"
15+
resource_group_name = azurerm_resource_group.example.name
16+
virtual_network_name = azurerm_virtual_network.example.name
17+
address_prefixes = ["10.0.2.0/24"]
18+
}
19+
20+
resource "azurerm_windows_virtual_machine_scale_set" "example" {
21+
name = "${var.name_prefix}-vmss"
22+
resource_group_name = azurerm_resource_group.example.name
23+
location = azurerm_resource_group.example.location
24+
25+
# Available skus for Confidential VMSS can be found at: https://docs.microsoft.com/azure/confidential-computing/confidential-vm-overview
26+
sku = "Standard_DC2as_v5"
27+
28+
instances = 2
29+
admin_username = "adminuser"
30+
admin_password = var.admin_password
31+
computer_name_prefix = "vmss"
32+
33+
source_image_reference {
34+
publisher = "MicrosoftWindowsServer"
35+
offer = "windows-cvm"
36+
sku = "2022-datacenter-cvm"
37+
version = "latest"
38+
}
39+
40+
os_disk {
41+
storage_account_type = "Premium_LRS"
42+
caching = "None"
43+
security_encryption_type = "VMGuestStateOnly"
44+
}
45+
46+
network_interface {
47+
name = "example"
48+
primary = true
49+
ip_configuration {
50+
name = "internal"
51+
primary = true
52+
subnet_id = azurerm_subnet.example.id
53+
}
54+
}
55+
56+
vtpm_enabled = true
57+
secure_boot_enabled = true
58+
}

‎quickstart/201-confidential-vmss/providers.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">=1.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "~>3.8"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {}
14+
}

0 commit comments

Comments
 (0)