[Compute] az disk create/grant-access: Support Confidential VM OS Disks (#31934)

Author: yanzhudd

src/azure-cli/azure/cli/command_modules/vm/_params.py

@@ -206,6 +206,7 @@ def load_arguments(self, _):
         c.argument('upload_type', arg_type=get_enum_type(['Upload', 'UploadWithSecurityData']), min_api='2018-09-30',
                    help="Create the disk for upload scenario. 'Upload' is for Standard disk only upload. 'UploadWithSecurityData' is for OS Disk upload along with VM Guest State. Please note the 'UploadWithSecurityData' is not valid for data disk upload, it only to be used for OS Disk upload at present.")
         c.argument('performance_plus', arg_type=get_three_state_flag(), min_api='2022-07-02', help='Set this flag to true to get a boost on the performance target of the disk deployed. This flag can only be set on disk creation time and cannot be disabled after enabled')
+        c.argument('security_metadata_uri', help='Specify the blob URI to be imported into VM metadata for Confidential VM')
     # endregion
 
     # region Snapshots

src/azure-cli/azure/cli/command_modules/vm/aaz/latest/disk/_create.py

@@ -70,9 +70,9 @@ class Create(AAZCommand):
     """
 
     _aaz_info = {
-        "version": "2023-04-02",
+        "version": "2025-01-02",
         "resources": [
-            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.compute/disks/{}", "2023-04-02"],
+            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.compute/disks/{}", "2025-01-02"],
         ]
     }
 
@@ -161,6 +161,11 @@ def _build_arguments_schema(cls, *args, **kwargs):
         # define Arg Group "Properties"
 
         _args_schema = cls._args_schema
+        _args_schema.availability_policy = AAZObjectArg(
+            options=["--availability-policy"],
+            arg_group="Properties",
+            help="Determines how platform treats disk failures",
+        )
         _args_schema.bursting_enabled = AAZBoolArg(
             options=["--bursting-enabled"],
             arg_group="Properties",
@@ -267,6 +272,13 @@ def _build_arguments_schema(cls, *args, **kwargs):
             help="Performance tier of the disk (e.g, P4, S10) as described here: https://azure.microsoft.com/en-us/pricing/details/managed-disks/. Does not apply to Ultra disks.",
         )
 
+        availability_policy = cls._args_schema.availability_policy
+        availability_policy.action_on_disk_delay = AAZStrArg(
+            options=["action-on-disk-delay"],
+            help="Determines on how to handle disks with slow I/O.",
+            enum={"AutomaticReattach": "AutomaticReattach", "None": "None"},
+        )
+
         creation_data = cls._args_schema.creation_data
         creation_data.create_option = AAZStrArg(
             options=["create-option"],
@@ -288,6 +300,13 @@ def _build_arguments_schema(cls, *args, **kwargs):
             help="Disk source information for PIR or user images.",
         )
         cls._build_args_image_disk_reference_create(creation_data.image_reference)
+        creation_data.instant_access_duration_minutes = AAZIntArg(
+            options=["instant-access-duration-minutes"],
+            help="For snapshots created from Premium SSD v2 or Ultra disk, this property determines the time in minutes the snapshot is retained for instant access to enable faster restore.",
+            fmt=AAZIntArgFormat(
+                minimum=1,
+            ),
+        )
         creation_data.logical_sector_size = AAZIntArg(
             options=["logical-sector-size"],
             help="Logical sector size in bytes for Ultra disks. Supported values are 512 ad 4096. 4096 is the default.",
@@ -296,10 +315,19 @@ def _build_arguments_schema(cls, *args, **kwargs):
             options=["performance-plus"],
             help="Set this flag to true to get a boost on the performance target of the disk deployed, see here on the respective performance target. This flag can only be set on disk creation time and cannot be disabled after enabled.",
         )
+        creation_data.provisioned_bandwidth_copy_speed = AAZStrArg(
+            options=["provisioned-bandwidth-copy-speed"],
+            help="If this field is set on a snapshot and createOption is CopyStart, the snapshot will be copied at a quicker speed.",
+            enum={"Enhanced": "Enhanced", "None": "None"},
+        )
         creation_data.security_data_uri = AAZStrArg(
             options=["security-data-uri"],
             help="If createOption is ImportSecure, this is the URI of a blob to be imported into VM guest state.",
         )
+        creation_data.security_metadata_uri = AAZStrArg(
+            options=["security-metadata-uri"],
+            help="If createOption is ImportSecure, this is the URI of a blob to be imported into VM metadata for Confidential VM.",
+        )
         creation_data.source_resource_id = AAZStrArg(
             options=["source-resource-id"],
             help="If createOption is Copy, this is the ARM id of the source snapshot or disk.",
@@ -336,7 +364,7 @@ def _build_arguments_schema(cls, *args, **kwargs):
         security_profile.security_type = AAZStrArg(
             options=["security-type"],
             help="Specifies the SecurityType of the VM. Applicable for OS disks only.",
-            enum={"ConfidentialVM_DiskEncryptedWithCustomerKey": "ConfidentialVM_DiskEncryptedWithCustomerKey", "ConfidentialVM_DiskEncryptedWithPlatformKey": "ConfidentialVM_DiskEncryptedWithPlatformKey", "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey": "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey", "TrustedLaunch": "TrustedLaunch"},
+            enum={"ConfidentialVM_DiskEncryptedWithCustomerKey": "ConfidentialVM_DiskEncryptedWithCustomerKey", "ConfidentialVM_DiskEncryptedWithPlatformKey": "ConfidentialVM_DiskEncryptedWithPlatformKey", "ConfidentialVM_NonPersistedTPM": "ConfidentialVM_NonPersistedTPM", "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey": "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey", "TrustedLaunch": "TrustedLaunch"},
         )
 
         supported_capabilities = cls._args_schema.supported_capabilities
@@ -353,6 +381,11 @@ def _build_arguments_schema(cls, *args, **kwargs):
             options=["disk-controller-types"],
             help="The disk controllers that an OS disk supports. If set it can be SCSI or SCSI, NVME or NVME, SCSI.",
         )
+        supported_capabilities.supported_security_option = AAZStrArg(
+            options=["supported-security-option"],
+            help="Refers to the security capability of the disk supported to create a Trusted launch or Confidential VM",
+            enum={"TrustedLaunchAndConfidentialVMSupported": "TrustedLaunchAndConfidentialVMSupported", "TrustedLaunchSupported": "TrustedLaunchSupported"},
+        )
         return cls._args_schema
 
     _args_image_disk_reference_create = None
@@ -438,7 +471,7 @@ def __call__(self, *args, **kwargs):
                     session,
                     self.on_200,
                     self.on_error,
-                    lro_options={"final-state-via": "azure-async-operation"},
+                    lro_options={"final-state-via": "location"},
                     path_format_arguments=self.url_parameters,
                 )
             if session.http_response.status_code in [200]:
@@ -447,7 +480,7 @@ def __call__(self, *args, **kwargs):
                     session,
                     self.on_200,
                     self.on_error,
-                    lro_options={"final-state-via": "azure-async-operation"},
+                    lro_options={"final-state-via": "location"},
                     path_format_arguments=self.url_parameters,
                 )
 
@@ -466,7 +499,7 @@ def method(self):
 
         @property
         def error_format(self):
-            return "MgmtErrorFormat"
+            return "ODataV4Format"
 
         @property
         def url_parameters(self):
@@ -490,7 +523,7 @@ def url_parameters(self):
         def query_parameters(self):
             parameters = {
                 **self.serialize_query_param(
-                    "api-version", "2023-04-02",
+                    "api-version", "2025-01-02",
                     required=True,
                 ),
             }
@@ -529,6 +562,7 @@ def content(self):
 
             properties = _builder.get(".properties")
             if properties is not None:
+                properties.set_prop("availabilityPolicy", AAZObjectType, ".availability_policy")
                 properties.set_prop("burstingEnabled", AAZBoolType, ".bursting_enabled")
                 properties.set_prop("creationData", AAZObjectType, ".creation_data", typ_kwargs={"flags": {"required": True}})
                 properties.set_prop("dataAccessAuthMode", AAZStrType, ".data_access_auth_mode")
@@ -550,15 +584,22 @@ def content(self):
                 properties.set_prop("supportsHibernation", AAZBoolType, ".supports_hibernation")
                 properties.set_prop("tier", AAZStrType, ".tier")
 
+            availability_policy = _builder.get(".properties.availabilityPolicy")
+            if availability_policy is not None:
+                availability_policy.set_prop("actionOnDiskDelay", AAZStrType, ".action_on_disk_delay")
+
             creation_data = _builder.get(".properties.creationData")
             if creation_data is not None:
                 creation_data.set_prop("createOption", AAZStrType, ".create_option", typ_kwargs={"flags": {"required": True}})
                 creation_data.set_prop("elasticSanResourceId", AAZStrType, ".elastic_san_resource_id")
                 _CreateHelper._build_schema_image_disk_reference_create(creation_data.set_prop("galleryImageReference", AAZObjectType, ".gallery_image_reference"))
                 _CreateHelper._build_schema_image_disk_reference_create(creation_data.set_prop("imageReference", AAZObjectType, ".image_reference"))
+                creation_data.set_prop("instantAccessDurationMinutes", AAZIntType, ".instant_access_duration_minutes")
                 creation_data.set_prop("logicalSectorSize", AAZIntType, ".logical_sector_size")
                 creation_data.set_prop("performancePlus", AAZBoolType, ".performance_plus")
+                creation_data.set_prop("provisionedBandwidthCopySpeed", AAZStrType, ".provisioned_bandwidth_copy_speed")
                 creation_data.set_prop("securityDataUri", AAZStrType, ".security_data_uri")
+                creation_data.set_prop("securityMetadataUri", AAZStrType, ".security_metadata_uri")
                 creation_data.set_prop("sourceResourceId", AAZStrType, ".source_resource_id")
                 creation_data.set_prop("sourceUri", AAZStrType, ".source_uri")
                 creation_data.set_prop("storageAccountId", AAZStrType, ".storage_account_id")
@@ -579,6 +620,7 @@ def content(self):
                 supported_capabilities.set_prop("acceleratedNetwork", AAZBoolType, ".accelerated_network")
                 supported_capabilities.set_prop("architecture", AAZStrType, ".architecture")
                 supported_capabilities.set_prop("diskControllerTypes", AAZStrType, ".disk_controller_types")
+                supported_capabilities.set_prop("supportedSecurityOption", AAZStrType, ".supported_security_option")
 
             sku = _builder.get(".sku")
             if sku is not None:
@@ -646,6 +688,7 @@ def _build_schema_disk_read(cls, _schema):
             _schema.name = cls._schema_disk_read.name
             _schema.properties = cls._schema_disk_read.properties
             _schema.sku = cls._schema_disk_read.sku
+            _schema.system_data = cls._schema_disk_read.system_data
             _schema.tags = cls._schema_disk_read.tags
             _schema.type = cls._schema_disk_read.type
             _schema.zones = cls._schema_disk_read.zones
@@ -678,6 +721,10 @@ def _build_schema_disk_read(cls, _schema):
             flags={"client_flatten": True},
         )
         disk_read.sku = AAZObjectType()
+        disk_read.system_data = AAZObjectType(
+            serialized_name="systemData",
+            flags={"read_only": True},
+        )
         disk_read.tags = AAZDictType()
         disk_read.type = AAZStrType(
             flags={"read_only": True},
@@ -696,6 +743,9 @@ def _build_schema_disk_read(cls, _schema):
             serialized_name="LastOwnershipUpdateTime",
             flags={"read_only": True},
         )
+        properties.availability_policy = AAZObjectType(
+            serialized_name="availabilityPolicy",
+        )
         properties.bursting_enabled = AAZBoolType(
             serialized_name="burstingEnabled",
         )
@@ -795,6 +845,11 @@ def _build_schema_disk_read(cls, _schema):
             flags={"read_only": True},
         )
 
+        availability_policy = _schema_disk_read.properties.availability_policy
+        availability_policy.action_on_disk_delay = AAZStrType(
+            serialized_name="actionOnDiskDelay",
+        )
+
         creation_data = _schema_disk_read.properties.creation_data
         creation_data.create_option = AAZStrType(
             serialized_name="createOption",
@@ -811,15 +866,24 @@ def _build_schema_disk_read(cls, _schema):
             serialized_name="imageReference",
         )
         cls._build_schema_image_disk_reference_read(creation_data.image_reference)
+        creation_data.instant_access_duration_minutes = AAZIntType(
+            serialized_name="instantAccessDurationMinutes",
+        )
         creation_data.logical_sector_size = AAZIntType(
             serialized_name="logicalSectorSize",
         )
         creation_data.performance_plus = AAZBoolType(
             serialized_name="performancePlus",
         )
+        creation_data.provisioned_bandwidth_copy_speed = AAZStrType(
+            serialized_name="provisionedBandwidthCopySpeed",
+        )
         creation_data.security_data_uri = AAZStrType(
             serialized_name="securityDataUri",
         )
+        creation_data.security_metadata_uri = AAZStrType(
+            serialized_name="securityMetadataUri",
+        )
         creation_data.source_resource_id = AAZStrType(
             serialized_name="sourceResourceId",
         )
@@ -931,13 +995,36 @@ def _build_schema_disk_read(cls, _schema):
         supported_capabilities.disk_controller_types = AAZStrType(
             serialized_name="diskControllerTypes",
         )
+        supported_capabilities.supported_security_option = AAZStrType(
+            serialized_name="supportedSecurityOption",
+        )
 
         sku = _schema_disk_read.sku
         sku.name = AAZStrType()
         sku.tier = AAZStrType(
             flags={"read_only": True},
         )
 
+        system_data = _schema_disk_read.system_data
+        system_data.created_at = AAZStrType(
+            serialized_name="createdAt",
+        )
+        system_data.created_by = AAZStrType(
+            serialized_name="createdBy",
+        )
+        system_data.created_by_type = AAZStrType(
+            serialized_name="createdByType",
+        )
+        system_data.last_modified_at = AAZStrType(
+            serialized_name="lastModifiedAt",
+        )
+        system_data.last_modified_by = AAZStrType(
+            serialized_name="lastModifiedBy",
+        )
+        system_data.last_modified_by_type = AAZStrType(
+            serialized_name="lastModifiedByType",
+        )
+
         tags = _schema_disk_read.tags
         tags.Element = AAZStrType()
 
@@ -952,6 +1039,7 @@ def _build_schema_disk_read(cls, _schema):
         _schema.name = cls._schema_disk_read.name
         _schema.properties = cls._schema_disk_read.properties
         _schema.sku = cls._schema_disk_read.sku
+        _schema.system_data = cls._schema_disk_read.system_data
         _schema.tags = cls._schema_disk_read.tags
         _schema.type = cls._schema_disk_read.type
         _schema.zones = cls._schema_disk_read.zones

src/azure-cli/azure/cli/command_modules/vm/aaz/latest/disk/_grant_access.py

@@ -25,9 +25,9 @@ class GrantAccess(AAZCommand):
     """
 
     _aaz_info = {
-        "version": "2023-04-02",
+        "version": "2025-01-02",
         "resources": [
-            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.compute/disks/{}/begingetaccess", "2023-04-02"],
+            ["mgmt-plane", "/subscriptions/{}/resourcegroups/{}/providers/microsoft.compute/disks/{}/begingetaccess", "2025-01-02"],
         ]
     }
 
@@ -139,7 +139,7 @@ def method(self):
 
         @property
         def error_format(self):
-            return "MgmtErrorFormat"
+            return "ODataV4Format"
 
         @property
         def url_parameters(self):
@@ -163,7 +163,7 @@ def url_parameters(self):
         def query_parameters(self):
             parameters = {
                 **self.serialize_query_param(
-                    "api-version", "2023-04-02",
+                    "api-version", "2025-01-02",
                     required=True,
                 ),
             }
@@ -220,6 +220,10 @@ def _build_schema_on_200(cls):
                 serialized_name="securityDataAccessSAS",
                 flags={"read_only": True},
             )
+            _schema_on_200.security_metadata_access_sas = AAZStrType(
+                serialized_name="securityMetadataAccessSAS",
+                flags={"read_only": True},
+            )
 
             return cls._schema_on_200
 

src/azure-cli/azure/cli/command_modules/vm/custom.py

@@ -364,7 +364,7 @@ def create_managed_disk(cmd, resource_group_name, disk_name, location=None,  # p
                         public_network_access=None, accelerated_network=None, architecture=None,
                         data_access_auth_mode=None, gallery_image_reference_type=None, security_data_uri=None,
                         upload_type=None, secure_vm_disk_encryption_set=None, performance_plus=None,
-                        optimized_for_frequent_attach=None):
+                        optimized_for_frequent_attach=None, security_metadata_uri=None):
 
     from azure.mgmt.core.tools import resource_id, is_valid_resource_id
     from azure.cli.core.commands.client_factory import get_subscription_id
@@ -459,7 +459,8 @@ def create_managed_disk(cmd, resource_group_name, disk_name, location=None,  # p
         "upload_size_bytes": upload_size_bytes,
         "logical_sector_size": logical_sector_size,
         "security_data_uri": security_data_uri,
-        "performance_plus": performance_plus
+        "performance_plus": performance_plus,
+        "security_metadata_uri": security_metadata_uri,
     }
 
     if size_gb is None and option == "Empty":