Skip to content

Commit ab52aa4

Browse files
SandidoSandido
authored
More examples for TrustedLaunch functionality in VM and VMSS creation (#23412)
* Update New-AzVM.md * Update New-AzVmss.md * Update ChangeLog.md * Update New-AzVmss.md * Update New-AzVmss.md * Update New-AzVmss.md * Update New-AzVM.md * Update New-AzVM.md * Update New-AzVM.md * Update New-AzVmss.md * Update New-AzVmss.md * Update New-AzVmss.md
1 parent 477e1b7 commit ab52aa4

File tree

3 files changed

+108
-17
lines changed

3 files changed

+108
-17
lines changed

‎src/Compute/Compute/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
2121
-->
2222
## Upcoming Release
23+
* Added new examples in `New-AzVM` and `New-AzVmss` for TrustedLaunch default usage.
2324

2425
## Version 7.0.0
2526
* Added update functionality in `Update-AzVmss` for parameters `SecurityType`, `EnableSecureBoot`, and `EnableVtpm` for the parameter set with the Put operation.

‎src/Compute/Compute/help/New-AzVM.md

Lines changed: 62 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ New-AzResourceGroup -Name $rgname -Location $loc -Force;
295295
$domainNameLabel1 = 'd1' + $rgname;
296296
$vmsize = 'Standard_D4s_v3';
297297
$vmname1 = 'v' + $rgname;
298-
$imageName = "Win2016DataCenterGenSecond";
298+
$imageName = "Win2022AzureEdition";
299299
$disable = $false;
300300
$enable = $true;
301301
$securityType = "TrustedLaunch";
@@ -313,16 +313,69 @@ $vm1 = Get-AzVM -ResourceGroupName $rgname -Name $vmname1;
313313
#$vm1.SecurityProfile.SecurityType "TrustedLaunch";
314314
#$vm1.SecurityProfile.UefiSettings.VTpmEnabled $true;
315315
#$vm1.SecurityProfile.UefiSettings.SecureBootEnabled $true;
316+
```
317+
This example Creates a new VM with the TrustedLaunch Security Type and sets flags EnableSecureBoot and EnableVtpm as True by default. A Trusted Launch VM requires a Gen2 image. Please check [the Trusted Launch feature page](aka.ms/trustedlaunch) for more information.
316318

317-
# Verify the GuestAttestation extension is installed.
318-
$vm = Get-AzVM -ResourceGroupName $rgname -Name $vmname1;
319-
$extDefaultName = "GuestAttestation";
320-
$vmExt = Get-AzVMExtension -ResourceGroupName $rgname -VMName $vmname1 -Name $extDefaultName;
321-
# verify $vmExt.Name is "GuestAttestation";
319+
### Example 9: Create a VM with Trusted Launch turned on by defualt using New-AzVMConfig.
320+
```powershell
321+
$rgname = "<Resource Group Name>";
322+
$loc = "<Azure Region>";
323+
$vmname = 'vm' + $rgname;
324+
$domainNameLabel = "d1" + $rgname;
325+
$vnetname = "vn" + $rgname;
326+
$vnetAddress = "10.0.0.0/16";
327+
$subnetname = "slb" + $rgname;
328+
$subnetAddress = "10.0.2.0/24";
329+
$OSDiskName = $vmname + "-osdisk";
330+
$NICName = $vmname+ "-nic";
331+
$NSGName = $vmname + "-NSG";
332+
$OSDiskSizeinGB = 128;
333+
$VMSize = "Standard_DS2_v2";
334+
$PublisherName = "MicrosoftWindowsServer";
335+
$Offer = "WindowsServer";
336+
$SKU = "2022-datacenter-azure-edition";
337+
$version = "latest";
338+
$password = "<Password>";
339+
$securePassword = $password | ConvertTo-SecureString -AsPlainText -Force;
340+
$user = <Username>;
341+
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);
342+
# Network setup
343+
$frontendSubnet = New-AzVirtualNetworkSubnetConfig -Name $subnetname -AddressPrefix $subnetAddress;
344+
$vnet = New-AzVirtualNetwork -Name $vnetname -ResourceGroupName $rgname -Location $loc -AddressPrefix $vnetAddress -Subnet $frontendSubnet;
345+
$nsgRuleRDP = New-AzNetworkSecurityRuleConfig -Name RDP -Protocol Tcp -Direction Inbound -Priority 1001 -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389 -Access Allow;
346+
$nsg = New-AzNetworkSecurityGroup -ResourceGroupName $RGName -Location $loc -Name $NSGName -SecurityRules $nsgRuleRDP;
347+
$nic = New-AzNetworkInterface -Name $NICName -ResourceGroupName $RGName -Location $loc -SubnetId $vnet.Subnets[0].Id -NetworkSecurityGroupId $nsg.Id -EnableAcceleratedNetworking;
348+
# VM
349+
$vmConfig = New-AzVMConfig -VMName $vmName -VMSize $VMSize;
350+
Set-AzVMOperatingSystem -VM $vmConfig -Windows -ComputerName $vmName -Credential $cred;
351+
Set-AzVMSourceImage -VM $vmConfig -PublisherName $PublisherName -Offer $Offer -Skus $SKU -Version $version ;
352+
Add-AzVMNetworkInterface -VM $vmConfig -Id $nic.Id;
353+
New-AzVM -ResourceGroupName $rgname -Location $loc -VM $vmConfig;
354+
$vm = Get-AzVM -ResourceGroupName $rgname -Name $vmname;
355+
# Verify $vm.SecurityProfile.SecurityType is TrustedLaunch
356+
# Verify $vm.SecurityProfile.UefiSettings.SecureBootEnabled is true.
357+
# Verify $vm.SecurityProfile.UefiSettings.VTpmEnabled is true.
358+
```
359+
This example shows how to create a VM with a valid Gen2 image, allowing the VM to default to TrustedLaunch which requires Gen2 images. Please check [the Trusted Launch feature page](aka.ms/trustedlaunch) for more information.
360+
361+
### Example 10: Creates a VM with TrustedLaunch turned on by default.
362+
```powershell
363+
$rgname = "<Resource Group Name>";
364+
$loc = "<Azure Region>";
365+
$vmname = 'vm' + $rgname;
366+
$domainNameLabel = "d1" + $rgname;
367+
$password = "<Password>";
368+
$securePassword = $password | ConvertTo-SecureString -AsPlainText -Force;
369+
$user = <Username>;
370+
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);
371+
# Create VM
372+
$vm = New-AzVM -ResourceGroupName $rgname -Name $vmname -Credential $cred -DomainNameLabel $domainNameLabel;
373+
$vm = Get-AzVM -ResourceGroupName $rgname -Name $vmname;
374+
# Verify $vm.SecurityProfile.SecurityType is TrustedLaunch.
375+
# Verify the $vm.StorageProfile.ImageReference.Sku has defaulted to "2022-datacenter-azure-edition", a Gen2 image.
322376
```
377+
This example shows how the simple cmdlet call with minimal parameters will result in a TrustedLaunch enabled VM with a Gen2 image. Please check [the Trusted Launch feature page](aka.ms/trustedlaunch) for more information.
323378

324-
This example Creates a new VM with the TrustedLaunch Security Type and sets flags EnableSecureBoot and EnableVtpm as True by default.
325-
It also checks that the GuestAttestation extension is installed by default when using TrustedLaunch and the EnableSecureBoot and EnableVtpm are True.
326379

327380
## PARAMETERS
328381

@@ -686,7 +739,7 @@ Accept wildcard characters: False
686739
```
687740
688741
### -Image
689-
The friendly image name upon which the VM will be built. The available aliases are: Win2022AzureEditionCore, Win2019Datacenter, Win2016Datacenter, Win2012R2Datacenter, Win2012Datacenter, Ubuntu2204, CentOS85Gen2, Debian11, OpenSuseLeap154Gen2, RHELRaw8LVMGen2, SuseSles15SP3, FlatcarLinuxFreeGen2.
742+
The friendly image name upon which the VM will be built. The available aliases are: Win2022AzureEdition, Win2022AzureEditionCore, Win2019Datacenter, Win2016Datacenter, Win2012R2Datacenter, Win2012Datacenter, Ubuntu2204, CentOS85Gen2, Debian11, OpenSuseLeap154Gen2, RHELRaw8LVMGen2, SuseSles15SP3, FlatcarLinuxFreeGen2.
690743
691744
```yaml
692745
Type: System.String

‎src/Compute/Compute/help/New-AzVmss.md

Lines changed: 45 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ schema: 2.0.0
99
# New-AzVmss
1010

1111
## SYNOPSIS
12-
Creates a VMSS.
12+
Creates a virtual machine scale set.
1313

1414
## SYNTAX
1515

@@ -209,14 +209,13 @@ Create a VMSS with a UserData value
209209

210210
### Example 4: Create a Vmss with the security type TrustedLaunch
211211
```powershell
212-
$rgname = "rganme";
212+
$rgname = "rgname";
213213
$loc = "eastus";
214214
215215
# VMSS Profile & Hardware requirements for the TrustedLaunch default behavior.
216216
$vmssSize = 'Standard_D4s_v3';
217217
$vmssName1 = 'vmss1' + $rgname;
218-
$vmssName2 = 'vmss2' + $rgname;
219-
$imageName = "Win2016DataCenterGenSecond";
218+
$imageName = "Win2022AzureEdition";
220219
$adminUsername = "<Username>";
221220
$adminPassword = "<Password>" | ConvertTo-SecureString -AsPlainText -Force;
222221
$vmCred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
@@ -228,7 +227,7 @@ $result = New-AzVmss -Credential $vmCred -VMScaleSetName $vmssName1 -ImageName $
228227
# $result.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled;
229228
```
230229

231-
This example Creates a new VMSS with the new Security Type 'TrustedLaunch' and the necessary UEFISettings values,
230+
This example Creates a new VMSS with the new Security Type 'TrustedLaunch' and the necessary UEFISettings values, VTpmEnabled and SecureBootEnalbed are true. Please check [the Trusted Launch feature page](aka.ms/trustedlaunch) for more information.
232231

233232
### Example 5: Create a Vmss in Orchestration Mode: Flexible by default
234233
```powershell
@@ -237,11 +236,49 @@ $vmssConfig = New-AzVmssConfig -Location EastUs2 -UpgradePolicyMode Manual -Sing
237236
238237
# VMSS Creation
239238
New-AzVmss -ResourceGroupName TestRg -VMScaleSetName myVMSS -VirtualMachineScaleSet $vmssConfig
240-
241239
```
242-
243240
This example Creates a new VMSS and it will default to OrchestrationMode Flexible.
244241

242+
### Example 6: Create a new VMSS with TrustedLaunch turned on by default.
243+
```powershell
244+
$rgname = "<Resource Group>";
245+
$loc = "<Azure Region>";
246+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
247+
248+
$vmssName = 'vmss' + $rgname;
249+
$vmssSize = 'Standard_D4s_v3';
250+
$imageName = "Win2022AzureEdition";
251+
$publisherName = "MicrosoftWindowsServer";
252+
$offer = "WindowsServer";
253+
$sku = "2022-Datacenter-Azure-Edition";
254+
$adminUsername = "<Username>";
255+
$password = "<Password>";
256+
257+
# NRP
258+
$vnetworkName = 'vnet' + $rgname;
259+
$subnetName = 'subnet' + $rgname;
260+
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix "10.0.0.0/24";
261+
$vnet = New-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
262+
$vnet = Get-AzVirtualNetwork -Name $vnetworkName -ResourceGroupName $rgname;
263+
$subnetId = $vnet.Subnets[0].Id;
264+
265+
$ipCfg = New-AzVmssIpConfig -Name 'test' -SubnetId $subnetId;
266+
267+
$vmss = New-AzVmssConfig -Location $loc -SkuCapacity 2 -SkuName $vmssSize -UpgradePolicyMode 'Manual' `
268+
| Add-AzVmssNetworkInterfaceConfiguration -Name 'test' -Primary $true -IPConfiguration $ipCfg `
269+
| Set-AzVmssOsProfile -ComputerNamePrefix 'test' -AdminUsername $adminUsername -AdminPassword $password;
270+
271+
# Create TL Vmss
272+
$result = New-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName -VirtualMachineScaleSet $vmss;
273+
$vmssGet = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName;
274+
275+
# Verify $vmssGet.VirtualMachineProfile.SecurityProfile.SecurityType is TrustedLaunch.
276+
# Verify $vmssGet.VirtualMachineProfile.SecurityProfile.UefiSettings.VTpmEnabled is True.
277+
# Verify $vmssGet.VirtualMachineProfile.SecurityProfile.UefiSettings.SecureBootEnabled is True.
278+
# Verify $vmssGet.VirtualMachineProfile.StorageProfile.ImageReference.Sku is 2022-Datacenter-Azure-Edition.
279+
```
280+
The virtual machine scale set above has Trusted Launch enabled by default. Please check [the Trusted Launch feature page](aka.ms/trustedlaunch) for more information.
281+
245282
## PARAMETERS
246283

247284
### -AllocationMethod
@@ -527,7 +564,7 @@ Accept wildcard characters: False
527564
```
528565
529566
### -ImageName
530-
The alias of the image for VMs in this Scale Set. If no value is provided, the "Windows Server 2016 DataCenter" image will be used. The available aliases are: Win2022AzureEditionCore, Win2019Datacenter, Win2016Datacenter, Win2012R2Datacenter, Win2012Datacenter, UbuntuLTS, Ubuntu2204, CentOS85Gen2, Debian11, OpenSuseLeap154Gen2, RHELRaw8LVMGen2, SuseSles15SP3, FlatcarLinuxFreeGen2.
567+
The alias of the image for VMs in this Scale Set. If no value is provided, the "Windows Server 2016 DataCenter" image will be used. The available aliases are: Win2022AzureEdition, Win2022AzureEditionCore, Win2019Datacenter, Win2016Datacenter, Win2012R2Datacenter, Win2012Datacenter, UbuntuLTS, Ubuntu2204, CentOS85Gen2, Debian11, OpenSuseLeap154Gen2, RHELRaw8LVMGen2, SuseSles15SP3, FlatcarLinuxFreeGen2.
531568
532569
```yaml
533570
Type: System.String

0 commit comments

Comments
 (0)