Skip to content

Commit 54732ec

Browse files
markcowlmarkcowl
authored
Merge pull request #3596 from chelnak/patch-1
Update Set-AzureRmVMDiskEncryptionExtension.md
2 parents 009ba23 + a101e63 commit 54732ec

File tree

1 file changed

+95
-83
lines changed

1 file changed

+95
-83
lines changed

‎src/ResourceManager/Compute/Commands.Compute/help/Set-AzureRmVMDiskEncryptionExtension.md

Lines changed: 95 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -41,129 +41,141 @@ It is advised that you save your work on the virtual machine before you run this
4141

4242
### Example 1: Enable encryption using Azure AD Client ID and Client Secret
4343
```
44-
PS C:\>$RGName = "MyResourceGroup";
45-
PS C:\> $VMName = "MyTestVM";
46-
PS C:\> $AADClientID = "<clientID of your Azure AD app>";
47-
PS C:\> $AADClientSecret = "<clientSecret of your Azure AD app>";
48-
PS C:\> $VaultName= "MyKeyVault";
49-
PS C:\> $KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName;
50-
PS C:\> $DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
51-
PS C:\> $KeyVaultResourceId = $KeyVault.ResourceId;
52-
PS C:\> Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientSecret $AADClientSecret -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId ;
44+
$RGName = "MyResourceGroup"
45+
$VMName = "MyTestVM"
46+
$AADClientID = "<clientID of your Azure AD app>"
47+
$AADClientSecret = "<clientSecret of your Azure AD app>"
48+
$VaultName= "MyKeyVault"
49+
$KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName
50+
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
51+
$KeyVaultResourceId = $KeyVault.ResourceId
52+
Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientSecret $AADClientSecret -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId
5353
```
5454

5555
This example enables encryption using Azure AD client ID, and client secret.
5656

5757
### Example 2: Enable encryption using Azure AD client ID and client certification thumbprint
5858
```
59-
PS C:\>$RGName = "MyResourceGroup";
60-
PS C:\> $VMName = "MyTestVM";
59+
$RGName = "MyResourceGroup"
60+
$VMName = "MyTestVM"
6161
#The KeyVault must have enabledForDiskEncryption property set on it
62-
PS C:\> $VaultName= "MyKeyVault";
63-
PS C:\> $KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName;
64-
PS C:\> $DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
65-
PS C:\> $KeyVaultResourceId = $KeyVault.ResourceId;
62+
$VaultName= "MyKeyVault"
63+
$KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName
64+
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
65+
$KeyVaultResourceId = $KeyVault.ResourceId
6666
6767
# create Azure AD application and associate the certificate
68-
PS C:\> $CertPath = "C:\certificates\examplecert.pfx";
69-
PS C:\> $CertPassword = "Password";
70-
PS C:\> $Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPassword);
71-
PS C:\> $KeyValue = [System.Convert]::ToBase64String($cert.GetRawCertData());
72-
PS C:\> $AzureAdApplication = New-AzureRmADApplication -DisplayName "<Your Application Display Name>" -HomePage "<https://YourApplicationHomePage>" -IdentifierUris "<https://YouApplicationUri>" -KeyValue $KeyValue -KeyType AsymmetricX509Cert ;
73-
PS C:\> $ServicePrincipal = New-AzureRmADServicePrincipal -ApplicationId $AzureAdApplication.ApplicationId;
68+
$CertPath = "C:\certificates\examplecert.pfx"
69+
$CertPassword = "Password"
70+
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPassword)
71+
$KeyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())
72+
$AzureAdApplication = New-AzureRmADApplication -DisplayName "<Your Application Display Name>" -HomePage "<https://YourApplicationHomePage>" -IdentifierUris "<https://YouApplicationUri>" -KeyValue $KeyValue -KeyType AsymmetricX509Cert
73+
$ServicePrincipal = New-AzureRmADServicePrincipal -ApplicationId $AzureAdApplication.ApplicationId
7474
75-
PS C:\> $AADClientID = $AzureAdApplication.ApplicationId;
76-
PS C:\> $aadClientCertThumbprint= $cert.Thumbprint;
75+
$AADClientID = $AzureAdApplication.ApplicationId
76+
$aadClientCertThumbprint= $cert.Thumbprint
7777
7878
#Upload pfx to KeyVault
79-
PS C:\> $KeyVaultSecretName = "MyAADCert';
80-
PS C:\> $FileContentBytes = get-content $CertPath -Encoding Byte;
81-
PS C:\> $FileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes);
82-
PS C:\> $JSONObject = @" { "data": "$filecontentencoded", "dataType" :"pfx", "password": "$CertPassword" } "@ ;
83-
PS C:\> $JSONObjectBytes = [System.Text.Encoding]::UTF8.GetBytes($jsonObject);
84-
PS C:\> $JSONEncoded = [System.Convert]::ToBase64String($jsonObjectBytes);
85-
86-
PS C:\> $Secret = ConvertTo-SecureString -String $JSONEncoded -AsPlainText -Force;
87-
PS C:\> Set-AzureKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName -SecretValue $Secret;
88-
PS C:\> Set-AzureRmKeyVaultAccessPolicy -VaultName $VaultName -ResourceGroupName $RGName -EnabledForDeployment;
79+
$KeyVaultSecretName = "MyAADCert"
80+
$FileContentBytes = get-content $CertPath -Encoding Byte
81+
$FileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes)
82+
$JSONObject = @"
83+
{
84+
"data" : "$filecontentencoded",
85+
"dataType" : "pfx",
86+
"password" : "$CertPassword"
87+
}
88+
"@
89+
$JSONObjectBytes = [System.Text.Encoding]::UTF8.GetBytes($jsonObject)
90+
$JSONEncoded = [System.Convert]::ToBase64String($jsonObjectBytes)
91+
92+
$Secret = ConvertTo-SecureString -String $JSONEncoded -AsPlainText -Force
93+
Set-AzureKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName -SecretValue $Secret
94+
Set-AzureRmKeyVaultAccessPolicy -VaultName $VaultName -ResourceGroupName $RGName -EnabledForDeployment
8995
9096
#deploy cert to VM
91-
PS C:\> $CertUrl = (Get-AzureKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName).Id
97+
$CertUrl = (Get-AzureKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName).Id
9298
$SourceVaultId = (Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName).ResourceId
93-
PS C:\> $VM = Get-AzureRmVM -ResourceGroupName $RGName -Name $VMName
94-
PS C:\> $VM = Add-AzureRmVMSecret -VM $VM -SourceVaultId $SourceVaultId -CertificateStore "My" -CertificateUrl $CertUrl
95-
PS C:\> Update-AzureRmVM -VM $VM -ResourceGroupName $RGName
99+
$VM = Get-AzureRmVM -ResourceGroupName $RGName -Name $VMName
100+
$VM = Add-AzureRmVMSecret -VM $VM -SourceVaultId $SourceVaultId -CertificateStore "My" -CertificateUrl $CertUrl
101+
Update-AzureRmVM -VM $VM -ResourceGroupName $RGName
96102
97103
#Enable encryption on the virtual machine using Azure AD client ID and client cert thumbprint
98-
PS C:\> Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientCertThumbprint $AADClientCertThumbprint -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId ;
104+
Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientCertThumbprint $AADClientCertThumbprint -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId
99105
```
100106

101107
This example enables encryption using Azure AD client ID and client certification thumbprints.
102108

103109
### Example 3: Enable encryption using Azure AD client ID, client secret, and wrap disk encryption key by using key encryption key
104110
```
105-
PS C:\>$RGName = "MyResourceGroup";
106-
PS C:\> $VMName = "MyTestVM";
111+
$RGName = "MyResourceGroup"
112+
$VMName = "MyTestVM"
107113
108-
PS C:\> $AADClientID = "<clientID of your Azure AD app>";
109-
PS C:\> $AADClientSecret = "<clientSecret of your Azure AD app>";
114+
$AADClientID = "<clientID of your Azure AD app>"
115+
$AADClientSecret = "<clientSecret of your Azure AD app>"
110116
111-
PS C:\> $VaultName= "MyKeyVault";
112-
PS C:\> $KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName;
113-
PS C:\> $DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
114-
PS C:\> $KeyVaultResourceId = $KeyVault.ResourceId;
117+
$VaultName= "MyKeyVault"
118+
$KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName
119+
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
120+
$KeyVaultResourceId = $KeyVault.ResourceId
115121
116-
PS C:\> $KEK = Add-AzureKeyVaultKey -VaultName $VaultName -Name $KEKName -Destination "Software"
117-
PS C:\> $KeyEncryptionKeyUrl = $KEK.Key.kid;
122+
$KEK = Add-AzureKeyVaultKey -VaultName $VaultName -Name $KEKName -Destination "Software"
123+
$KeyEncryptionKeyUrl = $KEK.Key.kid
118124
119-
PS C:\> Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientSecret $AADClientSecret -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $KeyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId;
125+
Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientSecret $AADClientSecret -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $KeyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId
120126
```
121127

122128
This example enables encryption using Azure AD client ID, client secret, and wrap disk encryption key by using the key encryption key.
123129

124130
### Example 4: Enable encryption using Azure AD client ID, client cert thumbprint, and wrap disk encryptionkey by using key encryption key
125131
```
126-
PS C:\>$RGName = "MyResourceGroup";
127-
PS C:\> $VMName = "MyTestVM";
132+
$RGName = "MyResourceGroup"
133+
$VMName = "MyTestVM"
128134
#The KeyVault must have enabledForDiskEncryption property set on it
129-
PS C:\> $VaultName= "MyKeyVault";
130-
PS C:\> $KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName;
131-
PS C:\> $DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
132-
PS C:\> $KeyVaultResourceId = $KeyVault.ResourceId;
133-
PS C:\> $KEK = Add-AzureKeyVaultKey -VaultName $VaultName -Name $KEKName -Destination "Software"
134-
PS C:\> $KeyEncryptionKeyUrl = $KEK.Key.kid;
135-
136-
PS C:\> # create Azure AD application and associate the certificate
137-
PS C:\> $CertPath = "C:\certificates\examplecert.pfx";
138-
PS C:\> $CertPassword = "Password";
139-
PS C:\> $Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPassword);
140-
PS C:\> $KeyValue = [System.Convert]::ToBase64String($cert.GetRawCertData());
141-
PS C:\> $AzureAdApplication = New-AzureRmADApplication -DisplayName "<Your Application Display Name>" -HomePage "<https://YourApplicationHomePage>" -IdentifierUris "<https://YouApplicationUri>" -KeyValue $KeyValue -KeyType AsymmetricX509Cert ;
142-
PS C:\> $ServicePrincipal = New-AzureRmADServicePrincipal -ApplicationId $AzureAdApplication.ApplicationId;
143-
144-
PS C:\> $AADClientID = $AzureAdApplication.ApplicationId;
145-
PS C:\> $AADClientCertThumbprint= $Cert.Thumbprint;
135+
$VaultName= "MyKeyVault"
136+
$KeyVault = Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName
137+
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
138+
$KeyVaultResourceId = $KeyVault.ResourceId
139+
$KEK = Add-AzureKeyVaultKey -VaultName $VaultName -Name $KEKName -Destination "Software"
140+
$KeyEncryptionKeyUrl = $KEK.Key.kid
141+
142+
# create Azure AD application and associate the certificate
143+
$CertPath = "C:\certificates\examplecert.pfx"
144+
$CertPassword = "Password"
145+
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPassword)
146+
$KeyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())
147+
$AzureAdApplication = New-AzureRmADApplication -DisplayName "<Your Application Display Name>" -HomePage "<https://YourApplicationHomePage>" -IdentifierUris "<https://YouApplicationUri>" -KeyValue $KeyValue -KeyType AsymmetricX509Cert
148+
$ServicePrincipal = New-AzureRmADServicePrincipal -ApplicationId $AzureAdApplication.ApplicationId
149+
150+
$AADClientID = $AzureAdApplication.ApplicationId
151+
$AADClientCertThumbprint= $Cert.Thumbprint
146152
147153
#Upload pfx to KeyVault
148-
PS C:\> $KeyVaultSecretName = "MyAADCert";
149-
PS C:\> $FileContentBytes = get-content $CertPath -Encoding Byte;
150-
PS C:\> $FileContentEncoded = [System.Convert]::ToBase64String($FileContentBytes);
151-
$JSONObject = @" { "data": "$filecontentencoded", "dataType" :"pfx", "password": "$CertPassword" } "@ ;
152-
PS C:\> $JSONObjectBytes =
153-
[System.Text.Encoding]::UTF8.GetBytes($JSONObject);$jsonEncoded = [System.Convert]::ToBase64String($JSONObjectBytes);
154-
PS C:\> $Secret = ConvertTo-SecureString -String $JSONEncoded -AsPlainText -Force;
155-
PS C:\> Set-AzureKeyVaultSecret -VaultName $VaultName-Name $KeyVaultSecretName -SecretValue $Secret;
156-
PS C:\> Set-AzureRmKeyVaultAccessPolicy -VaultName $VaultName -ResourceGroupName $RGName -EnabledForDeployment;
154+
$KeyVaultSecretName = "MyAADCert"
155+
$FileContentBytes = get-content $CertPath -Encoding Byte
156+
$FileContentEncoded = [System.Convert]::ToBase64String($FileContentBytes)
157+
$JSONObject = @"
158+
{
159+
"data" : "$filecontentencoded",
160+
"dataType" : "pfx",
161+
"password" : "$CertPassword"
162+
}
163+
"@
164+
$JSONObjectBytes = [System.Text.Encoding]::UTF8.GetBytes($JSONObject)
165+
$JsonEncoded = [System.Convert]::ToBase64String($JSONObjectBytes)
166+
$Secret = ConvertTo-SecureString -String $JSONEncoded -AsPlainText -Force
167+
Set-AzureKeyVaultSecret -VaultName $VaultName-Name $KeyVaultSecretName -SecretValue $Secret
168+
Set-AzureRmKeyVaultAccessPolicy -VaultName $VaultName -ResourceGroupName $RGName -EnabledForDeployment
157169
158170
#deploy cert to VM
159-
PS C:\> $CertUrl = (Get-AzureKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName).Id
160-
PS C:\> $SourceVaultId = (Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName).ResourceId
161-
PS C:\> $VM = Get-AzureRmVM -ResourceGroupName $RGName -Name $VMName
162-
PS C:\> $VM = Add-AzureRmVMSecret -VM $VM -SourceVaultId $SourceVaultId -CertificateStore "My" -CertificateUrl $CertUrl
163-
PS C:\> Update-AzureRmVM -VM $VM -ResourceGroupName $RGName
171+
$CertUrl = (Get-AzureKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName).Id
172+
$SourceVaultId = (Get-AzureRmKeyVault -VaultName $VaultName -ResourceGroupName $RGName).ResourceId
173+
$VM = Get-AzureRmVM -ResourceGroupName $RGName -Name $VMName
174+
$VM = Add-AzureRmVMSecret -VM $VM -SourceVaultId $SourceVaultId -CertificateStore "My" -CertificateUrl $CertUrl
175+
Update-AzureRmVM -VM $VM -ResourceGroupName $RGName
164176
165177
#Enable encryption on the virtual machine using Azure AD client ID and client cert thumbprint
166-
PS C:\> Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGname -VMName $VMName -AadClientID $AADClientID -AadClientCertThumbprint $AADClientCertThumbprint -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId ;
178+
Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $RGname -VMName $VMName -AadClientID $AADClientID -AadClientCertThumbprint $AADClientCertThumbprint -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId
167179
```
168180

169181
This example enables encryption using Azure AD client ID, client cert thumbprint, and wrap disk encryption key by using key encryption key.

0 commit comments

Comments
 (0)