Skip to content

Commit e0f9c4b

Browse files
grayzugrayzu
authored
Merge pull request microsoft#103 from myc2h6o/vm_ade
Add examples for Azure Disk Encryption Extension for VM and VMSS
2 parents aac920d + 191572b commit e0f9c4b

File tree

9 files changed

+382
-0
lines changed

9 files changed

+382
-0
lines changed

‎quickstart/201-vm-disk-encryption-extension/main.tf‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
resource "azurerm_resource_group" "example" {
2+
name = "${var.name_prefix}-rg"
3+
location = var.location
4+
}
5+
6+
// Key Vault Key
7+
data "azurerm_client_config" "current" {}
8+
9+
resource "azurerm_key_vault" "example" {
10+
name = "${var.name_prefix}-kv"
11+
location = azurerm_resource_group.example.location
12+
resource_group_name = azurerm_resource_group.example.name
13+
tenant_id = data.azurerm_client_config.current.tenant_id
14+
sku_name = "premium"
15+
enabled_for_disk_encryption = true
16+
purge_protection_enabled = true
17+
soft_delete_retention_days = 7
18+
}
19+
20+
resource "azurerm_key_vault_access_policy" "service-principal" {
21+
key_vault_id = azurerm_key_vault.example.id
22+
tenant_id = data.azurerm_client_config.current.tenant_id
23+
object_id = data.azurerm_client_config.current.object_id
24+
25+
key_permissions = [
26+
"Create",
27+
"Delete",
28+
"Get",
29+
"Update",
30+
]
31+
32+
secret_permissions = [
33+
"Get",
34+
"Delete",
35+
"Set",
36+
]
37+
}
38+
39+
resource "azurerm_key_vault_key" "example" {
40+
name = "examplekey"
41+
key_vault_id = azurerm_key_vault.example.id
42+
key_type = "RSA-HSM"
43+
key_size = 2048
44+
45+
key_opts = [
46+
"decrypt",
47+
"encrypt",
48+
"sign",
49+
"unwrapKey",
50+
"verify",
51+
"wrapKey",
52+
]
53+
54+
depends_on = [
55+
azurerm_key_vault_access_policy.service-principal
56+
]
57+
}
58+
59+
// Virtual Machine
60+
resource "azurerm_virtual_network" "example" {
61+
name = "${var.name_prefix}-vnet"
62+
address_space = ["10.0.0.0/16"]
63+
location = azurerm_resource_group.example.location
64+
resource_group_name = azurerm_resource_group.example.name
65+
}
66+
67+
resource "azurerm_subnet" "example" {
68+
name = "${var.name_prefix}-subnet"
69+
resource_group_name = azurerm_resource_group.example.name
70+
virtual_network_name = azurerm_virtual_network.example.name
71+
address_prefixes = ["10.0.2.0/24"]
72+
}
73+
74+
resource "azurerm_network_interface" "example" {
75+
name = "${var.name_prefix}-nic"
76+
location = azurerm_resource_group.example.location
77+
resource_group_name = azurerm_resource_group.example.name
78+
79+
ip_configuration {
80+
name = "internal"
81+
subnet_id = azurerm_subnet.example.id
82+
private_ip_address_allocation = "Dynamic"
83+
}
84+
}
85+
86+
resource "azurerm_linux_virtual_machine" "example" {
87+
name = "${var.name_prefix}-vm"
88+
resource_group_name = azurerm_resource_group.example.name
89+
location = azurerm_resource_group.example.location
90+
size = "Standard_D2s_v3"
91+
admin_username = "azureuser"
92+
network_interface_ids = [
93+
azurerm_network_interface.example.id,
94+
]
95+
96+
admin_ssh_key {
97+
username = "azureuser"
98+
public_key = var.vm_public_key
99+
}
100+
101+
source_image_reference {
102+
publisher = "Canonical"
103+
offer = "UbuntuServer"
104+
sku = "16.04-LTS"
105+
version = "latest"
106+
}
107+
108+
os_disk {
109+
storage_account_type = "Standard_LRS"
110+
caching = "ReadWrite"
111+
}
112+
}
113+
114+
// Disk Encryption Extension
115+
resource "azurerm_virtual_machine_extension" "example" {
116+
name = "AzureDiskEncryptionForLinux"
117+
publisher = "Microsoft.Azure.Security"
118+
type = "AzureDiskEncryptionForLinux"
119+
type_handler_version = "1.1"
120+
auto_upgrade_minor_version = false
121+
virtual_machine_id = azurerm_linux_virtual_machine.example.id
122+
123+
settings = jsonencode({
124+
"EncryptionOperation" = "EnableEncryption"
125+
"KeyEncryptionAlgorithm" = "RSA-OAEP"
126+
"KeyVaultURL" = azurerm_key_vault.example.vault_uri
127+
"KeyVaultResourceId" = azurerm_key_vault.example.id
128+
"KeyEncryptionKeyURL" = azurerm_key_vault_key.example.id
129+
"KekVaultResourceId" = azurerm_key_vault.example.id
130+
"VolumeType" = "All"
131+
})
132+
}

‎quickstart/201-vm-disk-encryption-extension/providers.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
terraform {
2+
required_version = ">=1.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "~>3.0"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {
14+
key_vault {
15+
recover_soft_deleted_key_vaults = false
16+
purge_soft_delete_on_destroy = false
17+
purge_soft_deleted_keys_on_destroy = false
18+
}
19+
}
20+
}

‎quickstart/201-vm-disk-encryption-extension/readme.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Azure virtual machine with disk encryption extension
2+
3+
This template deploys an Azure virtual machine with disk encryption extension.
4+
5+
## Resources
6+
7+
- [azurerm_key_vault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault)
8+
- [azurerm_key_vault_access_policy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy)
9+
- [azurerm_key_vault_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key)
10+
- [azurerm_linux_virtual_machine](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine)
11+
- [azurerm_network_interface](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface)
12+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
13+
- [azurerm_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)
14+
- [azurerm_virtual_machine_extension](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine_extension)
15+
- [azurerm_virtual_network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network)
16+
17+
## Variables
18+
19+
| Name | Description |
20+
|-|-|
21+
| `location` | (Required) Azure Region in which to deploy these resources.|
22+
| `name_prefix` | (Required) Prefix of the resource name.|
23+
| `vm_public_key` | (Required) Public key of the Virtual Machine.|
24+
25+
## Example
26+
27+
To see how to run this example, see [Create an Azure virtual machine with disk encryption extension using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-vm-with-disk-encryption-extension).

‎quickstart/201-vm-disk-encryption-extension/variables.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
variable "location" {
2+
type = string
3+
description = "Location where resources will be created"
4+
}
5+
6+
variable "name_prefix" {
7+
type = string
8+
description = "Prefix of the resource name"
9+
}
10+
11+
variable "vm_public_key" {
12+
type = string
13+
description = "Public key of the Virtual Machine"
14+
}

‎quickstart/201-vmss-disk-encryption-extension/main.tf‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
resource "azurerm_resource_group" "example" {
2+
name = "${var.name_prefix}-rg"
3+
location = var.location
4+
}
5+
6+
// Key Vault Key
7+
data "azurerm_client_config" "current" {}
8+
9+
resource "azurerm_key_vault" "example" {
10+
name = "${var.name_prefix}-kv"
11+
location = azurerm_resource_group.example.location
12+
resource_group_name = azurerm_resource_group.example.name
13+
tenant_id = data.azurerm_client_config.current.tenant_id
14+
sku_name = "premium"
15+
enabled_for_disk_encryption = true
16+
purge_protection_enabled = true
17+
soft_delete_retention_days = 7
18+
}
19+
20+
resource "azurerm_key_vault_access_policy" "service-principal" {
21+
key_vault_id = azurerm_key_vault.example.id
22+
tenant_id = data.azurerm_client_config.current.tenant_id
23+
object_id = data.azurerm_client_config.current.object_id
24+
25+
key_permissions = [
26+
"Create",
27+
"Delete",
28+
"Get",
29+
"Update",
30+
]
31+
32+
secret_permissions = [
33+
"Get",
34+
"Delete",
35+
"Set",
36+
]
37+
}
38+
39+
resource "azurerm_key_vault_key" "example" {
40+
name = "examplekey"
41+
key_vault_id = azurerm_key_vault.example.id
42+
key_type = "RSA-HSM"
43+
key_size = 3072
44+
45+
key_opts = [
46+
"decrypt",
47+
"encrypt",
48+
"sign",
49+
"unwrapKey",
50+
"verify",
51+
"wrapKey",
52+
]
53+
54+
depends_on = [
55+
azurerm_key_vault_access_policy.service-principal
56+
]
57+
}
58+
59+
// Virtual Machine Scale Set
60+
resource "azurerm_virtual_network" "example" {
61+
name = "${var.name_prefix}-vnet"
62+
address_space = ["10.0.0.0/16"]
63+
location = azurerm_resource_group.example.location
64+
resource_group_name = azurerm_resource_group.example.name
65+
}
66+
67+
resource "azurerm_subnet" "example" {
68+
name = "${var.name_prefix}-subnet"
69+
resource_group_name = azurerm_resource_group.example.name
70+
virtual_network_name = azurerm_virtual_network.example.name
71+
address_prefixes = ["10.0.2.0/24"]
72+
}
73+
74+
resource "azurerm_windows_virtual_machine_scale_set" "example" {
75+
name = "${var.name_prefix}-vmss"
76+
resource_group_name = azurerm_resource_group.example.name
77+
location = azurerm_resource_group.example.location
78+
sku = "Standard_D2s_v3"
79+
instances = 2
80+
admin_username = "adminuser"
81+
admin_password = var.admin_password
82+
computer_name_prefix = "vmss"
83+
upgrade_mode = "Automatic"
84+
85+
source_image_reference {
86+
publisher = "MicrosoftWindowsServer"
87+
offer = "WindowsServer"
88+
sku = "2022-Datacenter"
89+
version = "latest"
90+
}
91+
92+
os_disk {
93+
storage_account_type = "Premium_LRS"
94+
caching = "None"
95+
}
96+
97+
network_interface {
98+
name = "example"
99+
primary = true
100+
ip_configuration {
101+
name = "internal"
102+
primary = true
103+
subnet_id = azurerm_subnet.example.id
104+
}
105+
}
106+
}
107+
108+
// Disk Encryption Extension
109+
resource "azurerm_virtual_machine_scale_set_extension" "example" {
110+
name = "AzureDiskEncryption"
111+
publisher = "Microsoft.Azure.Security"
112+
type = "AzureDiskEncryption"
113+
type_handler_version = "2.2"
114+
auto_upgrade_minor_version = false
115+
virtual_machine_scale_set_id = azurerm_windows_virtual_machine_scale_set.example.id
116+
117+
settings = jsonencode({
118+
"EncryptionOperation" = "EnableEncryption"
119+
"KeyEncryptionAlgorithm" = "RSA-OAEP"
120+
"KeyVaultURL" = azurerm_key_vault.example.vault_uri
121+
"KeyVaultResourceId" = azurerm_key_vault.example.id
122+
"KeyEncryptionKeyURL" = azurerm_key_vault_key.example.id
123+
"KekVaultResourceId" = azurerm_key_vault.example.id
124+
"VolumeType" = "All"
125+
})
126+
}

‎quickstart/201-vmss-disk-encryption-extension/providers.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
terraform {
2+
required_version = ">=1.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "~>3.8"
8+
}
9+
}
10+
}
11+
12+
provider "azurerm" {
13+
features {
14+
key_vault {
15+
recover_soft_deleted_key_vaults = false
16+
purge_soft_delete_on_destroy = false
17+
purge_soft_deleted_keys_on_destroy = false
18+
}
19+
}
20+
}

‎quickstart/201-vmss-disk-encryption-extension/readme.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Azure virtual machine scale set with disk encryption extension
2+
3+
This template deploys an Azure virtual machine scale set with disk encryption extension.
4+
5+
## Resources
6+
7+
- [azurerm_key_vault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault)
8+
- [azurerm_key_vault_access_policy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy)
9+
- [azurerm_key_vault_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key)
10+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
11+
- [azurerm_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)
12+
- [azurerm_virtual_machine_scale_set_extension](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine_scale_set_extension)
13+
- [azurerm_virtual_network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network)
14+
- [azurerm_windows_virtual_machine_scale_set](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_virtual_machine_scale_set)
15+
16+
## Variables
17+
18+
| Name | Description |
19+
|-|-|
20+
| `admin_password` | (Required) Admin password of the virtual machine scale set.|
21+
| `location` | (Required) Azure Region in which to deploy these resources.|
22+
| `name_prefix` | (Required) Prefix of the resource name.|
23+
24+
## Example
25+
26+
To see how to run this example, see [Create an Azure virtual machine scale set with disk encryption extension using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-vmss-with-disk-encryption-extension).

‎quickstart/201-vmss-disk-encryption-extension/variables.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
variable "admin_password" {
2+
type = string
3+
sensitive = true
4+
description = "Admin password of the virtual machine scale set"
5+
}
6+
7+
variable "location" {
8+
type = string
9+
description = "Location where resources will be created"
10+
}
11+
12+
variable "name_prefix" {
13+
type = string
14+
description = "Prefix of the resource name"
15+
}

‎quickstart/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope
2929
- [Azure Kubernetes Service with Log Analytics](./201-aks-log-analytics/)
3030
- [Azure Kubernetes Service with Helm](./201-aks-helm/)
3131
- [Azure Kubernetes Service with ACR](./201-aks-acr-identity/)
32+
- [Azure Virtual Machine Disk Encryption Extension](./201-vm-disk-encryption-extension)
33+
- [Azure Virtual Machine Scale Set Disk Encryption Extension](./201-vmss-disk-encryption-extension)
3234
- [Azure virtual machine scale set with jumpbox](./201-vmss-jumpbox)
3335
- [Azure virtual machine scale set with jumpbox from Packer custom image](./201-vmss-packer-jumpbox)
3436
- [Azure PostgreSQL Flexible Server Database](./201-postgresql-fs-db)

0 commit comments

Comments
 (0)