Skip to content

Commit 0a74225

Browse files
stankovskistankovski
committed
Merge pull request Azure#1588 from SudhakaraReddyEvuri/dev
Pre-requisites script for AzureDiskEncryption
2 parents 372b318 + eb642af commit 0a74225

File tree

1 file changed

+182
-0
lines changed

1 file changed

+182
-0
lines changed

‎src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/Scripts/AzureDiskEncryptionPreRequisiteSetup.ps1

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
2+
Param(
3+
[Parameter(Mandatory = $true,
4+
HelpMessage="Name of the resource group to which the KeyVault belongs to. A new resource group with this name will be created if one doesn't exist")]
5+
[ValidateNotNullOrEmpty()]
6+
[string]$resourceGroupName,
7+
8+
[Parameter(Mandatory = $true,
9+
HelpMessage="Name of the KeyVault in which encryption keys are to be placed. A new vault with this name will be created if one doesn't exist")]
10+
[ValidateNotNullOrEmpty()]
11+
[string]$keyVaultName,
12+
13+
[Parameter(Mandatory = $true,
14+
HelpMessage="Location of the KeyVault. Important note: Make sure the KeyVault and VMs to be encrypted are in the same region / location.")]
15+
[ValidateNotNullOrEmpty()]
16+
[string]$location,
17+
18+
[Parameter(Mandatory = $true,
19+
HelpMessage="Name of the AAD application that will be used to write secrets to KeyVault. A new application with this name will be created if one doesn't exist. If this app already exists, pass aadClientSecret parameter to the script")]
20+
[ValidateNotNullOrEmpty()]
21+
[string]$aadAppName,
22+
23+
[Parameter(Mandatory = $false,
24+
HelpMessage="Client secret of the AAD application that was created earlier")]
25+
[ValidateNotNullOrEmpty()]
26+
[string]$aadClientSecret,
27+
28+
[Parameter(Mandatory = $false,
29+
HelpMessage="Identifier of the Azure subscription to be used. Default subscription will be used if not specified.")]
30+
[ValidateNotNullOrEmpty()]
31+
[string]$subscriptionId,
32+
33+
[Parameter(Mandatory = $false,
34+
HelpMessage="Name of optional key encryption key in KeyVault. A new key with this name will be created if one doesn't exist")]
35+
[ValidateNotNullOrEmpty()]
36+
[string]$keyEncryptionKeyName
37+
38+
)
39+
40+
########################################################################################################################
41+
# Section1: Log-in to Azure and select appropriate subscription.
42+
########################################################################################################################
43+
44+
45+
Write-Host 'Please log into Azure now' -foregroundcolor Green;
46+
Login-AzureRmAccount -ErrorAction "Stop" 1> $null;
47+
48+
if($subscriptionId)
49+
{
50+
Select-AzureRmSubscription -SubscriptionId $subscriptionId;
51+
}
52+
53+
54+
########################################################################################################################
55+
# Section2: Create AAD app . Fill in $aadClientSecret variable if AAD app was already created
56+
########################################################################################################################
57+
58+
59+
# Check if AAD app with $aadAppName was already created
60+
$SvcPrincipals = (Get-AzureRmADServicePrincipal -SearchString $aadAppName);
61+
if(-not $SvcPrincipals)
62+
{
63+
# Create a new AD application if not created before
64+
$identifierUri = [string]::Format("http://localhost:8080/{0}",[Guid]::NewGuid().ToString("N"));
65+
$defaultHomePage = 'http://contoso.com';
66+
$now = [System.DateTime]::Now;
67+
$oneYearFromNow = $now.AddYears(1);
68+
$aadClientSecret = [Guid]::NewGuid();
69+
70+
Write-Host "Creating new AAD application ($aadAppName)";
71+
$ADApp = New-AzureRmADApplication -DisplayName $aadAppName -HomePage $defaultHomePage -IdentifierUris $identifierUri -StartDate $now -EndDate $oneYearFromNow -Password $aadClientSecret;
72+
$servicePrincipal = New-AzureRmADServicePrincipal -ApplicationId $ADApp.ApplicationId;
73+
$SvcPrincipals = (Get-AzureRmADServicePrincipal -SearchString $aadAppName);
74+
if(-not $SvcPrincipals)
75+
{
76+
# AAD app wasn't created
77+
Write-Error "Failed to create AAD app $aadAppName. Please log-in to Azure using Login-AzureRmAccount and try again";
78+
return;
79+
}
80+
$aadClientID = $servicePrincipal.ApplicationId;
81+
Write-Host "Created a new AAD Application ($aadAppName) with ID: $aadClientID ";
82+
}
83+
else
84+
{
85+
if(-not $aadClientSecret)
86+
{
87+
Write-Error "Aad application ($aadAppName) was alerady created. Re-run the script by supplying aadClientSecret parameter with corresponding secret from https://manage.windowsazure.com portal";
88+
return;
89+
}
90+
$aadClientID = $SvcPrincipals[0].ApplicationId;
91+
}
92+
93+
# Before proceeding to Section3, make sure $aadClientID and $aadClientSecret have valid values
94+
########################################################################################################################
95+
# Section3: Create KeyVault or setup existing keyVault
96+
########################################################################################################################
97+
98+
Try
99+
{
100+
$resGroup = Get-AzureRmResourceGroup -Name $resourceGroupName -ErrorAction SilentlyContinue;
101+
}
102+
Catch [System.ArgumentException]
103+
{
104+
Write-Host "Couldn't find resource group: ($resourceGroupName)";
105+
$resGroup = $null;
106+
}
107+
108+
#Create a new resource group if it doesn't exist
109+
if (-not $resGroup)
110+
{
111+
Write-Host "Creating new resource group: ($resourceGroupName)";
112+
$resGroup = New-AzureRmResourceGroup -Name $resourceGroupName -Location $location;
113+
Write-Host "Created a new resource group named $resourceGroupName to place keyVault";
114+
}
115+
116+
Try
117+
{
118+
$keyVault = Get-AzureRmKeyVault -VaultName $keyVaultName -ErrorAction SilentlyContinue;
119+
}
120+
Catch [System.ArgumentException]
121+
{
122+
Write-Host "Couldn't find Key Vault: $keyVaultName";
123+
$keyVault = $null;
124+
}
125+
126+
#Create a new vault if vault doesn't exist
127+
if (-not $keyVault)
128+
{
129+
Write-Host "Creating new key vault: ($keyVaultName)";
130+
$keyVault = New-AzureRmKeyVault -VaultName $keyVaultName -ResourceGroupName $resourceGroupName -Sku Standard -Location $location;
131+
Write-Host "Created a new KeyVault named $keyVaultName to store encryption keys";
132+
}
133+
# Specify full privileges to the vault for the AAD application
134+
Set-AzureRmKeyVaultAccessPolicy -VaultName $keyVaultName -ServicePrincipalName $aadClientID -PermissionsToKeys all -PermissionsToSecrets all;
135+
136+
Set-AzureRmKeyVaultAccessPolicy -VaultName $keyVaultName -EnabledForDiskEncryption;
137+
138+
$diskEncryptionKeyVaultUrl = $keyVault.VaultUri;
139+
$keyVaultResourceId = $keyVault.ResourceId;
140+
141+
if($keyEncryptionKeyName)
142+
{
143+
Try
144+
{
145+
$kek = Get-AzureKeyVaultKey -VaultName $keyVaultName -Name $keyEncryptionKeyName -ErrorAction SilentlyContinue;
146+
}
147+
Catch [Microsoft.Azure.KeyVault.KeyVaultClientException]
148+
{
149+
Write-Host "Couldn't find key encryption key named : $keyEncryptionKeyName in Key Vault: $keyVaultName";
150+
$kek = $null;
151+
}
152+
153+
if(-not $kek)
154+
{
155+
Write-Host "Creating new key encryption key named:$keyEncryptionKeyName in Key Vault: $keyVaultName";
156+
$kek = Add-AzureKeyVaultKey -VaultName $keyVaultName -Name $keyEncryptionKeyName -Destination Software -ErrorAction SilentlyContinue;
157+
Write-Host "Created key encryption key named:$keyEncryptionKeyName in Key Vault: $keyVaultName";
158+
}
159+
160+
$keyEncryptionKeyUrl = $kek.Key.Kid;
161+
}
162+
163+
########################################################################################################################
164+
# Section3: Displays values that should be used while enabling encryption. Please note these down
165+
########################################################################################################################
166+
Write-Host "Please note down below aadClientID, aadClientSecret, diskEncryptionKeyVaultUrl, keyVaultResourceId values that will be needed to enable encryption on your VMs " -foregroundcolor Green;
167+
Write-Host "`t aadClientID: $aadClientID" -foregroundcolor Green;
168+
Write-Host "`t aadClientSecret: $aadClientSecret" -foregroundcolor Green;
169+
Write-Host "`t diskEncryptionKeyVaultUrl: $diskEncryptionKeyVaultUrl" -foregroundcolor Green;
170+
Write-Host "`t keyVaultResourceId: $keyVaultResourceId" -foregroundcolor Green;
171+
if($keyEncryptionKeyName)
172+
{
173+
Write-Host "`t keyEncryptionKeyURL: $keyEncryptionKeyUrl" -foregroundcolor Green;
174+
}
175+
Write-Host "Please Press [Enter] after saving values displayed above. They are needed to enable encryption using Set-AzureRmVmDiskEncryptionExtension cmdlet" -foregroundcolor Green;
176+
Read-Host;
177+
178+
########################################################################################################################
179+
# For each VM you want to encrypt, run the below cmdlet
180+
# $vmName = 'Name of VM to encrypt';
181+
# Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $resourceGroupName -VMName $vmName -AadClientID $aadClientID -AadClientSecret $aadClientSecret -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $keyVaultResourceId;
182+
########################################################################################################################

0 commit comments

Comments
 (0)