Skip to content

Commit 321a888

Browse files
PMEds28PMEds28
authored
Merge pull request #226186 from lakmeedee/patch-589
Update trusted-launch-portal.md
2 parents e02e8d1 + cc2767b commit 321a888

File tree

1 file changed

+214
-9
lines changed

1 file changed

+214
-9
lines changed

‎articles/virtual-machines/trusted-launch-portal.md

Lines changed: 214 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -157,9 +157,23 @@ You can deploy trusted launch VMs using a quickstart template:
157157

158158
---
159159

160-
## Deploy a trusted launch VM from an Azure Compute Gallery image
160+
## Deploy a Trusted launch VM from an Azure Compute Gallery image
161161

162-
### [Portal](#tab/portal2)
162+
[Azure trusted launch virtual machines](trusted-launch.md) supports the creation and sharing of custom images using Azure Compute Gallery. There are two types of images that you can create, based on the security types of the image:
163+
164+
- [Trusted launch VM (`TrustedLaunch`) images](#trusted-launch-vm-images) are images where the source usually has [VM Guest state information](trusted-launch.md#what-is-vm-guest-state-vmgs) and can be used to create only Azure Trusted launch VMs.
165+
- [Trusted launch VM Supported (`TrustedLaunchSupported`) images](#trusted-launch-vm-supported-images) are images where the source doesn't have VM Guest state information and can be used to create either Azure Gen2 VMs or Azure Trusted launch VMs.
166+
167+
### Trusted launch VM Images
168+
169+
For the following image sources, the security type on the image definition should be set to `TrustedLaunch` as the image source already has [VM Guest state information](trusted-launch.md#what-is-vm-guest-state-vmgs):
170+
- Trusted launch VM capture
171+
- Managed OS disk
172+
- Managed OS disk snapshot
173+
174+
The resulting image version can be used only to create Azure Trusted launch VMs.
175+
176+
#### [Portal](#tab/portal2)
163177

164178
1. Sign in to the Azure [portal](https://portal.azure.com).
165179
2. To create an Azure Compute Gallery Image from a VM, open an existing Trusted launch VM and select **Capture**.
@@ -177,7 +191,8 @@ You can deploy trusted launch VMs using a quickstart template:
177191
14. The image and the security type are already populated based on the selected image version. The **Secure Boot** and **vTPM** checkboxes are enabled by default.
178192
15. Fill in the **Administrator account** information and then **Inbound port rules**.
179193
16. At the bottom of the page, select **Review + Create**
180-
17. On the **Create a virtual machine** page, you can see the details about the VM you are about to deploy. Once validation shows as passed, select **Create**.
194+
1. On the validation page, review the details of the VM.
195+
1. After the validation succeeds, select **Create** to finish creating the VM.
181196

182197
In case you want to use either a managed disk or a managed disk snapshot as a source of the image version (instead of a trusted launch VM), then use the following steps
183198

@@ -193,10 +208,10 @@ In case you want to use either a managed disk or a managed disk snapshot as a so
193208
10. The **Encryption** tab can also be used to provide SSE encryption related information, if required.
194209
11. Select **Create** in the **Review + create** tab to create the image
195210
12. Once the image version is successfully created, select the **+ Create VM** to land on the Create a virtual machine page.
196-
13. Please follow steps 12 to 17 as mentioned earlier to create a trusted launch VM using this image version
211+
13. Follow steps 12 to 18 as mentioned earlier to create a trusted launch VM using this image version
197212

198213

199-
### [CLI](#tab/cli2)
214+
#### [CLI](#tab/cli2)
200215

201216
Make sure you are running the latest version of Azure CLI
202217

@@ -228,21 +243,22 @@ az sig image-version create --resource-group MyResourceGroup \
228243

229244
In case a managed disk or a managed disk snapshot needs to be used as the image source for the image version, replace the --managed-image in the above command with --os-snapshot and provide the disk or the snapshot resource name
230245

231-
Create a Trusted Launch VM from the above image version
246+
Create a Trusted launch VM from the above image version
232247

233248
```azurecli-interactive
234249
adminUsername=linuxvm
235250
az vm create --resource-group MyResourceGroup \
236251
--name myTrustedLaunchVM \
237252
--image "/subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/galleries/MyGallery/images/MyImageDef" \
253+
--size Standard_D2s_v5 \
238254
--security-type TrustedLaunch \
239255
--enable-secure-boot true \
240256
--enable-vtpm true \
241257
--admin-username $adminUsername \
242258
--generate-ssh-keys
243259
```
244260

245-
### [PowerShell](#tab/powershell2)
261+
#### [PowerShell](#tab/powershell2)
246262

247263
Create an image definition with `TrustedLaunch` security type
248264

@@ -271,15 +287,203 @@ $galleryImageVersionName = "1.0.0"
271287
$sourceImageId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myVMRG/providers/Microsoft.Compute/virtualMachines/myVM"
272288
New-AzGalleryImageVersion -ResourceGroupName $rgName -GalleryName $galleryName -GalleryImageDefinitionName $galleryImageDefinitionName -Name $galleryImageVersionName -Location $location -SourceImageId $sourceImageId
273289
```
274-
Create a Trusted Launch VM from the above image version
290+
Create a Trusted launch VM from the above image version
291+
292+
```azurepowershell-interactive
293+
$rgName = "MyResourceGroup"
294+
$galleryName = "MyGallery"
295+
$galleryImageDefinitionName = "MyImageDef"
296+
$location = "eastus"
297+
$vmName = "myVMfromImage"
298+
$vmSize = "Standard_D2s_v5"
299+
$imageDefinition = Get-AzGalleryImageDefinition `
300+
-GalleryName $galleryName `
301+
-ResourceGroupName $rgName `
302+
-Name $galleryImageDefinitionName
303+
$cred = Get-Credential `
304+
-Message "Enter a username and password for the virtual machine"
305+
# Network pieces
306+
$subnetConfig = New-AzVirtualNetworkSubnetConfig `
307+
-Name mySubnet `
308+
-AddressPrefix 192.168.1.0/24
309+
$vnet = New-AzVirtualNetwork `
310+
-ResourceGroupName $rgName `
311+
-Location $location `
312+
-Name MYvNET `
313+
-AddressPrefix 192.168.0.0/16 `
314+
-Subnet $subnetConfig
315+
$pip = New-AzPublicIpAddress `
316+
-ResourceGroupName $rgName `
317+
-Location $location `
318+
-Name "mypublicdns$(Get-Random)" `
319+
-AllocationMethod Static `
320+
-IdleTimeoutInMinutes 4
321+
$nsgRuleRDP = New-AzNetworkSecurityRuleConfig `
322+
-Name myNetworkSecurityGroupRuleRDP `
323+
-Protocol Tcp `
324+
-Direction Inbound `
325+
-Priority 1000 `
326+
-SourceAddressPrefix * `
327+
-SourcePortRange * `
328+
-DestinationAddressPrefix * `
329+
-DestinationPortRange 3389 `
330+
-Access Deny
331+
$nsg = New-AzNetworkSecurityGroup `
332+
-ResourceGroupName $rgName `
333+
-Location $location `
334+
-Name myNetworkSecurityGroup `
335+
-SecurityRules $nsgRuleRDP
336+
$nic = New-AzNetworkInterface `
337+
-Name myNic `
338+
-ResourceGroupName $rgName `
339+
-Location $location `
340+
-SubnetId $vnet.Subnets[0].Id `
341+
-PublicIpAddressId $pip.Id `
342+
-NetworkSecurityGroupId $nsg.Id
343+
$vm = New-AzVMConfig -vmName $vmName -vmSize $vmSize | `
344+
Set-AzVMOperatingSystem -Windows -ComputerName $vmName -Credential $cred | `
345+
Set-AzVMSourceImage -Id $imageDefinition.Id | `
346+
Add-AzVMNetworkInterface -Id $nic.Id
347+
$vm = Set-AzVMSecurityProfile -SecurityType "TrustedLaunch" -VM $vm
348+
$vm = Set-AzVmUefi -VM $vm `
349+
-EnableVtpm $true `
350+
-EnableSecureBoot $true
351+
New-AzVM `
352+
-ResourceGroupName $rgName `
353+
-Location $location `
354+
-VM $vm
355+
```
356+
---
357+
358+
### Trusted launch VM Supported Images
359+
360+
For the following image sources, the security type on the image definition should be set to `TrustedLaunchsupported` as the image source does not have VM Guest state information:
361+
- Gen2 OS Disk VHD
362+
- Gen2 Managed Image
363+
- Gen2 Gallery Image Version
364+
365+
The resulting image version can be used to create either Azure Gen2 VMs or Trusted launch VMs.
366+
367+
These images can be shared with specific subscriptions or tenants through [Azure Compute Gallery - Direct Shared Gallery](../virtual-machines/azure-compute-gallery.md#shared-directly-to-a-tenant-or-subscription) and with all Azure users using [Azure Compute Gallery - Community Gallery](../virtual-machines/azure-compute-gallery.md#community-gallery)
368+
369+
> [!NOTE]
370+
> The OS disk VHD, Managed Image or Gallery Image Version should be created from a [Gen2 image that is compatible with Trusted launch VMs](trusted-launch.md#limitations).
371+
372+
#### [Portal](#tab/portal3)
373+
374+
1. Sign in to the [Azure portal](https://portal.azure.com).
375+
1. Search for and select **VM image versions** in the search bar
376+
1. On the **VM image versions** page, select **Create**.
377+
1. On the **Create VM image version** page, on the **Basics** tab:
378+
1. Select the Azure subscription.
379+
1. Select an existing resource group or create a new resource group.
380+
1. Select the Azure region.
381+
1. Enter an image version number.
382+
1. For **Source**, select either **Storage Blobs (VHD)** or **Managed Image** or another **VM Image Version**
383+
1. If you selected **Storage Blobs (VHD)**, enter an OS disk VHD (without the VM Guest state). Make sure to use a Gen 2 VHD.
384+
1. If you selected **Managed Image**, select an existing managed image of a Gen 2 VM.
385+
1. If you selected **VM Image Version**, select an existing Gallery Image Version of a Gen2 VM.
386+
1. For **Target Azure compute gallery**, select or create a gallery to share the image.
387+
1. For **Operating system state**, select either **Generalized** or **Specialized** depending on your use case. If you're using a managed image as the source, always select **Generalized**. If you're using a storage blob (VHD) and want to select **Generalized**, follow the steps to [generalize a Linux VHD](../virtual-machines/linux/create-upload-generic.md) or [generalize a Windows VHD](../virtual-machines/windows/upload-generalized-managed.md) before you continue. If you're using an existing VM Image Version, select either **Generalized** or **Specialized** based on what is used in the source VM image definition.
388+
1. For **Target VM Image Definition**, select **Create new**.
389+
1. In the **Create a VM image definition** pane, enter a name for the definition. Make sure the security type is set to **Trustedlaunch Supported**. Enter publisher, offer, and SKU information. Then, select **Ok**.
390+
1. On the **Replication** tab, enter the replica count and target regions for image replication, if required.
391+
1. On the **Encryption** tab, enter SSE encryption-related information, if required.
392+
1. Select **Review + Create**.
393+
1. After the configuration is successfully validated, select **Create** to finish creating the image.
394+
1. After the image version is created, select **Create VM**.
395+
12. In the Create a virtual machine page, under **Resource group**, select **Create new** and type a name for your resource group or select an existing resource group from the dropdown.
396+
13. Under **Instance details**, type a name for the virtual machine name and choose a region that supports [trusted launch](trusted-launch.md#limitations).
397+
14. Select **Trusted launch virtual machines** as the security type. The **Secure Boot** and **vTPM** checkboxes are enabled by default.
398+
15. Fill in the **Administrator account** information and then **Inbound port rules**.
399+
1. On the validation page, review the details of the VM.
400+
1. After the validation succeeds, select **Create** to finish creating the VM.
401+
402+
403+
#### [CLI](#tab/cli3)
404+
405+
Make sure you are running the latest version of Azure CLI
406+
407+
Sign in to Azure using `az login`.
408+
409+
```azurecli-interactive
410+
az login
411+
```
412+
413+
Create an image definition with `TrustedLaunchSupported` security type
414+
415+
```azurecli-interactive
416+
az sig image-definition create --resource-group MyResourceGroup --location eastus \
417+
--gallery-name MyGallery --gallery-image-definition MyImageDef \
418+
--publisher TrustedLaunchPublisher --offer TrustedLaunchOffer --sku TrustedLaunchSku \
419+
--os-type Linux --os-state Generalized \
420+
--hyper-v-generation V2 \
421+
--features SecurityType=TrustedLaunchSupported
422+
```
423+
424+
Use an OS disk VHD to create an image version. Ensure that the Linux VHD was generalized before uploading to an Azure storage account blob using steps outlined [here](../virtual-machines/linux/create-upload-generic.md)
425+
426+
```azurecli-interactive
427+
az sig image-version create --resource-group MyResourceGroup \
428+
--gallery-name MyGallery --gallery-image-definition MyImageDef \
429+
--gallery-image-version 1.0.0 \
430+
--os-vhd-storage-account /subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/imageGroups/providers/Microsoft.Storage/storageAccounts/mystorageaccount \
431+
--os-vhd-uri https://mystorageaccount.blob.core.windows.net/container/path_to_vhd_file
432+
```
433+
434+
Create a Trusted launch VM from the above image version
435+
436+
```azurecli-interactive
437+
adminUsername=linuxvm
438+
az vm create --resource-group MyResourceGroup \
439+
--name myTrustedLaunchVM \
440+
--image "/subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/galleries/MyGallery/images/MyImageDef" \
441+
--size Standard_D2s_v5 \
442+
--security-type TrustedLaunch \
443+
--enable-secure-boot true \
444+
--enable-vtpm true \
445+
--admin-username $adminUsername \
446+
--generate-ssh-keys
447+
```
448+
449+
#### [PowerShell](#tab/powershell3)
450+
451+
Create an image definition with `TrustedLaunch` security type
452+
453+
```azurepowershell-interactive
454+
$rgName = "MyResourceGroup"
455+
$galleryName = "MyGallery"
456+
$galleryImageDefinitionName = "MyImageDef"
457+
$location = "eastus"
458+
$publisherName = "TrustedlaunchPublisher"
459+
$offerName = "TrustedlaunchOffer"
460+
$skuName = "TrustedlaunchSku"
461+
$description = "My gallery"
462+
$SecurityType = @{Name='SecurityType';Value='TrustedLaunchSupported'}
463+
$features = @($SecurityType)
464+
New-AzGalleryImageDefinition -ResourceGroupName $rgName -GalleryName $galleryName -Name $galleryImageDefinitionName -Location $location -Publisher $publisherName -Offer $offerName -Sku $skuName -HyperVGeneration "V2" -OsState "Generalized" -OsType "Windows" -Description $description -Feature $features
465+
```
466+
467+
To create an image version, we can use an existing Gen2 Gallery Image Version which was generalized during creation.
468+
469+
```azurepowershell-interactive
470+
$rgName = "MyResourceGroup"
471+
$galleryName = "MyGallery"
472+
$galleryImageDefinitionName = "MyImageDef"
473+
$location = "eastus"
474+
$galleryImageVersionName = "1.0.0"
475+
$sourceImageId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myVMRG/providers/Microsoft.Compute/galleries/MyGallery/images/Gen2VMImageDef/versions/0.0.1"
476+
New-AzGalleryImageVersion -ResourceGroupName $rgName -GalleryName $galleryName -GalleryImageDefinitionName $galleryImageDefinitionName -Name $galleryImageVersionName -Location $location -SourceImageId $sourceImageId
477+
```
478+
Create a Trusted launch VM from the above image version
275479

276480
```azurepowershell-interactive
277481
$rgName = "MyResourceGroup"
278482
$galleryName = "MyGallery"
279483
$galleryImageDefinitionName = "MyImageDef"
280484
$location = "eastus"
281485
$vmName = "myVMfromImage"
282-
$vmSize = "Standard_D2s_v3"
486+
$vmSize = "Standard_D2s_v5"
283487
$imageDefinition = Get-AzGalleryImageDefinition `
284488
-GalleryName $galleryName `
285489
-ResourceGroupName $rgName `
@@ -338,6 +542,7 @@ New-AzVM `
338542
-VM $vm
339543
```
340544
---
545+
341546
## Verify or update your settings
342547

343548
For VMs created with trusted launch enabled, you can view the trusted launch configuration by visiting the **Overview** page for the VM in the portal. The **Properties** tab will show the status of Trusted Launch features:

0 commit comments

Comments
 (0)