You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Updated Compute resources with security recommendations (#947)
* Updated security diskEncyptionSet
* Updated VirtualMAchine with security recommendations
* Updated bicep file
* Updated readme
* Fix readme
* Updated VM module with security recommendations
* Updated VM scale set and VM descriptions and readme
* Fixed parameters file problems
* Added diskEncryptionSetId to VMs files
* Added diskEncryptionSet
* Updated VM scale set diskEncryptionSet
* Updated oSDisk description into bicep and readme files
* Commented extensionDiskEncryptionConfig
* Updated readmes and commented extension on VMs
* Updated Readmes and bicep descriptions
* Uncommented encryption extension and removed diskEncryptionSet
* Updating Readme based on Linter error
* Updated api version based on broken links check error
Co-authored-by: Elena Batanero García <elbatane@microsoft.com>
Copy file name to clipboardExpand all lines: arm/Microsoft.Compute/diskEncryptionSets/deploy.bicep
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -10,12 +10,12 @@ param keyVaultId string
10
10
@description('Required. Key URL (with version) pointing to a key or secret in KeyVault.')
11
11
paramkeyUrlstring
12
12
13
-
@description('Optional. The type of key used to encrypt the data of the disk.')
13
+
@description('Optional. The type of key used to encrypt the data of the disk. For security reasons, it is recommended to set encryptionType to EncryptionAtRestWithPlatformAndCustomerKeys')
Copy file name to clipboardExpand all lines: arm/Microsoft.Compute/diskEncryptionSets/readme.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ This template deploys a disk encryption set.
15
15
| Parameter Name | Type | Default Value | Possible Values | Description |
16
16
| :-- | :-- | :-- | :-- | :-- |
17
17
|`cuaId`| string ||| Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered |
18
-
|`encryptionType`| string |`EncryptionAtRestWithCustomerKey`|`[EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys]`| Optional. The type of key used to encrypt the data of the disk. |
18
+
|`encryptionType`| string |`EncryptionAtRestWithPlatformAndCustomerKeys`|`[EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys]`| Optional. The type of key used to encrypt the data of the disk. For security reasons, it is recommended to set 'encryptionType' to 'EncryptionAtRestWithPlatformAndCustomerKeys'|
19
19
|`keyUrl`| string ||| Required. Key URL (with version) pointing to a key or secret in KeyVault. |
20
20
|`keyVaultId`| string ||| Required. Resource ID of the KeyVault containing the key or secret. |
Copy file name to clipboardExpand all lines: arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
+24-3Lines changed: 24 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -4,16 +4,28 @@ param name string
4
4
@description('Optional. Location for all resources.')
5
5
paramlocationstring = resourceGroup().location
6
6
7
+
@description('Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your virtual machine scale sets.')
8
+
paramencryptionAtHostbool = true
9
+
10
+
@description('Optional. Specifies the SecurityType of the virtual machine scale set. It is set as TrustedLaunch to enable UefiSettings.')
11
+
paramsecurityTypestring = ''
12
+
13
+
@description('Optional. Specifies whether secure boot should be enabled on the virtual machine scale set. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings.')
14
+
paramsecureBootEnabledbool = false
15
+
16
+
@description('Optional. Specifies whether vTPM should be enabled on the virtual machine scale set. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings.')
17
+
paramvTpmEnabledbool = false
18
+
7
19
@description('Required. OS image reference. In case of marketplace images, it\'s the combination of the publisher, offer, sku, version attributes. In case of custom images it\'s the resource ID of the custom image.')
8
20
paramimageReferenceobject
9
21
10
22
@description('Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use.')
11
23
paramplanobject = {}
12
24
13
-
@description('Required. Specifies the OS disk.')
25
+
@description('Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VM Scale sets.')
14
26
paramosDiskobject
15
27
16
-
@description('Optional. Specifies the data disks.')
28
+
@description('Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VM Scale sets.')
17
29
paramdataDisksarray = []
18
30
19
31
@description('Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled.')
|`cuaId`| string ||| Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered |
35
35
|`customData`| string ||| Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format. |
36
-
|`dataDisks`| array |`[]`|| Optional. Specifies the data disks. |
36
+
|`dataDisks`| array |`[]`|| Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VM Scale sets. |
37
37
|`diagnosticEventHubAuthorizationRuleId`| string ||| Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to. |
38
38
|`diagnosticEventHubName`| string ||| Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. |
39
39
|`diagnosticLogsRetentionInDays`| int |`365`|| Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely. |
@@ -46,6 +46,7 @@ The following resources are required to be able to deploy this resource.
46
46
|`enableAutomaticUpdates`| bool |`True`|| Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning. |
47
47
|`enableEvictionPolicy`| bool ||| Optional. Specifies the eviction policy for the low priority virtual machine. Will result in 'Deallocate' eviction policy. |
48
48
|`enableServerSideEncryption`| bool ||| Optional. Specifies if Windows VM disks should be encrypted with Server-side encryption + Customer managed Key. |
49
+
|`encryptionAtHost`| bool |`True`|| Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine scale set. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VM Scale sets. |
49
50
|`extensionAntiMalwareConfig`| object |`{object}`|| Optional. The configuration for the [Anti Malware] extension. Must at least contain the ["enabled": true] property to be executed |
50
51
|`extensionCustomScriptConfig`| object |`{object}`|| Optional. The configuration for the [Custom Script] extension. Must at least contain the ["enabled": true] property to be executed |
51
52
|`extensionDependencyAgentConfig`| object |`{object}`|| Optional. The configuration for the [Dependency Agent] extension. Must at least contain the ["enabled": true] property to be executed |
@@ -68,7 +69,7 @@ The following resources are required to be able to deploy this resource.
68
69
|`monitoringWorkspaceId`| string ||| Optional. Resource ID of the monitoring log analytics workspace. |
69
70
|`name`| string ||| Required. Name of the VMSS. |
70
71
|`nicConfigurations`| array |`[]`|| Required. Configures NICs and PIPs. |
71
-
|`osDisk`| object ||| Required. Specifies the OS disk. |
72
+
|`osDisk`| object ||| Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VM Scale sets.|
72
73
|`osType`| string ||`[Windows, Linux]`| Required. The chosen OS type |
73
74
|`overprovision`| bool ||| Optional. Specifies whether the Virtual Machine Scale Set should be overprovisioned. |
74
75
|`pauseTimeBetweenBatches`| string |`PT0S`|| Optional. The wait time between completing the update for all virtual machines in one batch and starting the next batch. The time duration should be specified in ISO 8601 format |
@@ -83,17 +84,20 @@ The following resources are required to be able to deploy this resource.
83
84
|`scaleSetFaultDomain`| int |`2`|| Optional. Fault Domain count for each placement group. |
84
85
|`scheduledEventsProfile`| object |`{object}`|| Optional. Specifies Scheduled Event related configurations |
85
86
|`secrets`| array |`[]`|| Optional. Specifies set of certificates that should be installed onto the virtual machines in the scale set. |
87
+
|`securityType`| string ||`TrustedLaunch`| Optional. Specifies the SecurityType of the virtual machine scale set. It is set as TrustedLaunch to enable UefiSettings. |
88
+
|`secureBootEnabled`| bool |`False`|| Optional. Specifies whether secure boot should be enabled on the virtual machine scale set. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings. |
86
89
|`singlePlacementGroup`| bool |`True`|| Optional. When true this limits the scale set to a single placement group, of max size 100 virtual machines. NOTE: If singlePlacementGroup is true, it may be modified to false. However, if singlePlacementGroup is false, it may not be modified to true. |
87
90
|`skuCapacity`| int |`1`|| Optional. The initial instance count of scale set VMs. |
88
91
|`skuName`| string ||| Required. The SKU size of the VMs. |
89
92
|`systemAssignedIdentity`| bool ||| Optional. Enables system assigned managed identity on the resource. |
90
93
|`tags`| object |`{object}`|| Optional. Tags of the resource. |
91
-
|`timeZone`| string ||| Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be TimeZoneInfo.id value from time zones returned by TimeZoneInfo.GetSystemTimeZones. |
94
+
|`timeZone`| string ||| Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be 'TimeZoneInfo.id' value from time zones returned by TimeZoneInfo.GetSystemTimeZones. |
92
95
|`ultraSSDEnabled`| bool ||| Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled. |
93
96
|`upgradePolicyMode`| string |`Manual`|`[Manual, Automatic, Rolling]`| Optional. Specifies the mode of an upgrade to virtual machines in the scale set.' Manual - You control the application of updates to virtual machines in the scale set. You do this by using the manualUpgrade action. ; Automatic - All virtual machines in the scale set are automatically updated at the same time. - Automatic, Manual, Rolling |
94
97
|`userAssignedIdentities`| object |`{object}`|| Optional. The ID(s) to assign to the resource. |
95
98
|`vmNamePrefix`| string |`vmssvm`|| Optional. Specifies the computer name prefix for all of the virtual machines in the scale set. |
96
99
|`vmPriority`| string |`Regular`|`[Regular, Low, Spot]`| Optional. Specifies the priority for the virtual machine. |
100
+
|`vTpmEnabled`| bool |`False`|| Optional. Specifies whether vTPM should be enabled on the virtual machine scale set. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings. |
97
101
|`winRM`| object |`{object}`|| Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell. - WinRMConfiguration object. |
98
102
|`zoneBalance`| bool ||| Optional. Whether to force strictly even Virtual Machine distribution cross x-zones in case there is zone outage. |
99
103
@@ -140,7 +144,10 @@ The following resources are required to be able to deploy this resource.
140
144
"createOption": "fromImage",
141
145
"diskSizeGB": "128",
142
146
"managedDisk": {
143
-
"storageAccountType": "Premium_LRS"
147
+
"storageAccountType": "Premium_LRS",
148
+
"diskEncryptionSet": { // Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VM Scale sets.
@description('Optional. Specifies the size for the VMs')
9
9
paramvmSizestring = 'Standard_D2s_v3'
10
10
11
+
@description('Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs.')
12
+
paramencryptionAtHostbool = true
13
+
14
+
@description('Optional. Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings.')
15
+
paramsecurityTypestring = ''
16
+
17
+
@description('Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings.')
18
+
paramsecureBootEnabledbool = false
19
+
20
+
@description('Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings.')
21
+
paramvTpmEnabledbool = false
22
+
11
23
@description('Required. OS image reference. In case of marketplace images, it\'s the combination of the publisher, offer, sku, version attributes. In case of custom images it\'s the resource ID of the custom image.')
12
24
paramimageReferenceobject
13
25
14
26
@description('Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use.')
15
27
paramplanobject = {}
16
28
17
-
@description('Required. Specifies the OS disk.')
29
+
@description('Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs.')
18
30
paramosDiskobject
19
31
20
-
@description('Optional. Specifies the data disks.')
32
+
@description('Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs.')
21
33
paramdataDisksarray = []
22
34
23
35
@description('Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled.')
0 commit comments