Azure Terraform - 加密虚拟机操作系统磁盘

Question

我希望通过Terraform加密Azure VM上的“storage_os_disk”。我已经在VM OS磁盘上设置了托管磁盘类型，以便进行管理，因为我知道必须管理该磁盘才能允许加密。

我似乎无法弄清如何在Terraform中对OS磁盘进行加密。

以下是我正在尝试的代码：

resource "azurerm_network_interface" "nic" {
  name                = "${var.project_ident}-${var.env_ident}-${var.admin_vm_name}-${var.region_suffix}-encrpytest"
  location            = "${data.azurerm_resource_group.core-rg.location}"
  resource_group_name = "${data.azurerm_resource_group.core-rg.name}"
  depends_on            = ["azurerm_virtual_machine.dns-vm"]

  ip_configuration {
    name                          = "${var.project_ident}-${var.env_ident}-${var.admin_vm_name}-${var.region_suffix}-encrpytest"
    subnet_id                     ="${data.terraform_remote_state.network.sn1_id}"
    private_ip_address_allocation = "static"
    private_ip_address            = "${cidrhost(data.terraform_remote_state.network.sn1_address_prefix, 6 )}"
  }  
}

resource "azurerm_virtual_machine" "admin-vm-encrpytest" {
  name                  = "${var.project_ident}-${var.env_ident}-${var.admin_vm_name}-encrpytest"
  location              = "${data.azurerm_resource_group.core-rg.location}"
  resource_group_name   = "${data.azurerm_resource_group.core-rg.name}"
  network_interface_ids = ["${azurerm_network_interface.nic.id}"]
  vm_size               = "Standard_B2s"
  depends_on            = ["azurerm_virtual_machine.dns-vm"]


  # Requires LRS Storage Account
   boot_diagnostics {
   enabled      = "True"
   storage_uri  = "${data.terraform_remote_state.sa.sa_2_prim_blob_ep}"
   #storage_uri  = "${data.azurerm_storage_account.storage-account-2.primary_blob_endpoint}"
  }

  storage_os_disk {
    name          = "${var.project_ident}-${var.env_ident}-${var.admin_vm_name}-${var.region_suffix}-encrpytest"
    create_option = "FromImage"
    managed_disk_type = "Standard_LRS"

    encryption_settings {
      enabled      = "True"

      key_encryption_key {
        key_url = "${data.terraform_remote_state.kv.vault_key_1_id}"
        source_vault_id = "${data.terraform_remote_state.kv.vault_id}"
      }

      disk_encryption_key {
        secret_url = "${data.terraform_remote_state.kv.vault_key_2_id}"
        source_vault_id = "${data.terraform_remote_state.kv.vault_id}"
      }
    }


  }

  os_profile {
    computer_name  = "encrpytest"
    admin_username = "cactusadmin"
    admin_password = "${var.admin_vm_password}"
  }

  os_profile_windows_config {
    provision_vm_agent        = true
    enable_automatic_upgrades = true
  }

  # Uncomment this line to delete the OS disk automatically when deleting the VM
  delete_os_disk_on_termination = true

  # Uncomment this line to delete the data disks automatically when deleting the VM
  delete_data_disks_on_termination = true

  storage_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2016-Datacenter"
    version   = "latest"
  }
}

谢谢您

- Gvazzana

---

在我的情况下，我使用了 encryption_at_host_enabled = true。 - Rajesh Swarnkar

Answer 1

首先，在storage_os_disk块中不存在encryption_settings，但在azurerm_managed_disk中存在。因此，您可以创建一个单独的azurerm_managed_disk资源，然后使用平台映像从托管磁盘创建VM，参见此处。

另外，您也可以尝试使用azurerm_virtual_machine_extension进行磁盘加密，请参考这里。

resource "azurerm_virtual_machine_extension" "disk-encryption" {
  name                 = "DiskEncryption"
  location             = "${local.location}"
  resource_group_name  = "${azurerm_resource_group.environment-rg.name}"
  virtual_machine_name = "${azurerm_virtual_machine.server.name}"
  publisher            = "Microsoft.Azure.Security"
  type                 = "AzureDiskEncryption"
  type_handler_version = "2.2"

  settings = <<SETTINGS
{
  "EncryptionOperation": "EnableEncryption",
  "KeyVaultURL": "https://${local.vaultname}.vault.azure.net",
  "KeyVaultResourceId": "/subscriptions/${local.subscriptionid}/resourceGroups/${local.vaultresourcegroup}/providers/Microsoft.KeyVault/vaults/${local.vaultname}",
  "KeyEncryptionKeyURL": "https://${local.vaultname}.vault.azure.net/keys/${local.keyname}/${local.keyversion}",
  "KekVaultResourceId": "/subscriptions/${local.subscriptionid}/resourceGroups/${local.vaultresourcegroup}/providers/Microsoft.KeyVault/vaults/${local.vaultname}",
  "KeyEncryptionAlgorithm": "RSA-OAEP",
  "VolumeType": "All"
}
SETTINGS
}

- Nancy Xiong

---

感谢您的回复。我注意到在使用托管磁盘时需要使用加密设置，但是创建托管磁盘时，无论我尝试使用哪个“image_reference_id”，都无法接受。我甚至尝试通过PowerShell传递ID：“$vmImageId = az vm image show --urn $($vmImagePublisher + ":" + $vmImageOffer + ":" + $vmImageSku + ":" + $vmImageVersion) --query 'id' -o json”。使用“平台映像”的方法的问题是我需要使用最新的映像，而它不提供版本参数。我正在考虑尝试VM扩展，但我觉得那是一个开箱即用的解决方案。 - Gvazzana

该扩展似乎只适用于 Windows 虚拟机。安装时，我收到一个错误提示，无法运行用于安装的 exe 文件。 - leeman24

Answer 2

我使用了虚拟机扩展示例，它完美地工作了。我的新部署的 Windows 虚拟机上的操作系统磁盘立即被加密。

- Gvazzana