Skip to content

Commit d0ccc5f

Browse files
lakmeedeelakmeedee
authored
Update trusted-launch-portal.md
1 parent 6c508ae commit d0ccc5f

File tree

1 file changed

+211
-2
lines changed

1 file changed

+211
-2
lines changed

‎articles/virtual-machines/trusted-launch-portal.md

Lines changed: 211 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,9 +154,217 @@ You can deploy trusted launch VMs using a quickstart template:
154154

155155
---
156156

157-
## Deploy a trusted launch VM from an Azure Compute Gallery image
157+
## Deploy a Trusted launch VM from an Azure Compute Gallery image
158158

159-
### [Portal](#tab/portal2)
159+
[Azure trusted launch virtual machines](trusted-launch.md) supports the creation and sharing of custom images using Azure Compute Gallery. There are two types of images that you can create, based on the security types of the image:
160+
161+
- [Trusted Launch VM (`Trustedlaunch`) images](#trusted-launch-vm-images) are images where the source already has [VM Guest state information](trustedlaunch#what-is-vm-guest-state-vmgs).
162+
- [Trusted launch VM supported (`Trustedlaunchsupported`) images](#trusted-launch-vm-supported-images) are images where the source doesn't have VM Guest state information.
163+
164+
### Trusted Launch VM Images
165+
166+
For the following image sources, the security type on the image definition should be set to `Trustedlaunch` as the image source already has [VM Guest state information](trustedlaunch#what-is-vm-guest-state-vmgs):
167+
- Trusted launch VM capture
168+
- Managed OS disk
169+
- Managed OS disk snapshot
170+
171+
The resulting image version can be used only to create Azure Trusted launch VMs.
172+
173+
#### [Portal](#tab/portal2)
174+
175+
1. Sign in to the Azure [portal](https://portal.azure.com).
176+
2. To create an Azure Compute Gallery Image from a VM, open an existing Trusted launch VM and select **Capture**.
177+
3. In the Create an Image page that follows, allow the image to be shared to the gallery as a VM image version. Creation of Managed Images is not supported for Trusted Launch VMs.
178+
4. Create a new target Azure Compute Gallery or select an existing gallery.
179+
5. Select the **Operating system state** as either **Generalized** or **Specialized**. If you want to create a generalized image, ensure that you [generalize the VM to remove machine specific information](generalize.md) before selecting this option. If Bitlocker based encryption is enabled on your Trusted launch Windows VM, you may not be able to generalize the same.
180+
6. Create a new image definition by providing a name, publisher, offer and SKU details. The **Security Type** of the image definition should already be set to **Trusted launch**.
181+
7. Provide a version number for the image version.
182+
8. Modify replication options if required.
183+
9. At the bottom of the **Create an Image** page, select **Review + Create** and when validation shows as passed, select **Create**.
184+
10. Once the image version is created, go the image version directly. Alternatively, you can navigate to the required image version through the image definition.
185+
11. On the **VM image version** page, select the **+ Create VM** to land on the Create a virtual machine page.
186+
12. In the Create a virtual machine page, under **Resource group**, select **Create new** and type a name for your resource group or select an existing resource group from the dropdown.
187+
13. Under **Instance details**, type a name for the virtual machine name and choose a region that supports [trusted launch](trusted-launch.md#limitations).
188+
14. The image and the security type are already populated based on the selected image version. The **Secure Boot** and **vTPM** checkboxes are enabled by default.
189+
15. Fill in the **Administrator account** information and then **Inbound port rules**.
190+
16. At the bottom of the page, select **Review + Create**
191+
17. On the **Create a virtual machine** page, you can see the details about the VM you are about to deploy. Once validation shows as passed, select **Create**.
192+
193+
In case you want to use either a managed disk or a managed disk snapshot as a source of the image version (instead of a trusted launch VM), then use the following steps
194+
195+
1. Sign in to the [portal](https://portal.azure.com)
196+
2. Search for **VM Image Versions** and select **Create**
197+
3. Provide the subscription, resource group, region and image version number
198+
4. Select the source as **Disks and/or Snapshots**
199+
5. Select the OS disk as a managed disk or a managed disk snapshot from the dropdown list
200+
6. Select a **Target Azure Compute Gallery** to create and share the image. If no gallery exists, create a new gallery.
201+
7. Select the **Operating system state** as either **Generalized** or **Specialized**. If you want to create a generalized image, ensure that you generalize the disk or snapshot to remove machine specific information.
202+
8. For the **Target VM Image Definition** select Create new. In the window that opens, select an image definition name and ensure that the **Security type** is set to **Trusted launch**. Provide the publisher, offer and SKU information and select **OK**.
203+
9. The **Replication** tab can be used to set the replica count and target regions for image replication, if required.
204+
10. The **Encryption** tab can also be used to provide SSE encryption related information, if required.
205+
11. Select **Create** in the **Review + create** tab to create the image
206+
12. Once the image version is successfully created, select the **+ Create VM** to land on the Create a virtual machine page.
207+
13. Please follow steps 12 to 17 as mentioned earlier to create a trusted launch VM using this image version
208+
209+
210+
### [CLI](#tab/cli2)
211+
212+
Make sure you are running the latest version of Azure CLI
213+
214+
Sign in to Azure using `az login`.
215+
216+
```azurecli-interactive
217+
az login
218+
```
219+
220+
Create an image definition with `TrustedLaunch` security type
221+
222+
```azurecli-interactive
223+
az sig image-definition create --resource-group MyResourceGroup --location eastus \
224+
--gallery-name MyGallery --gallery-image-definition MyImageDef \
225+
--publisher TrustedLaunchPublisher --offer TrustedLaunchOffer --sku TrustedLaunchSku \
226+
--os-type Linux --os-state Generalized \
227+
--hyper-v-generation V2 \
228+
--features SecurityType=TrustedLaunch
229+
```
230+
231+
To create an image version, we can capture an existing Linux based Trusted launch VM. [Generalize the Trusted launch VM](generalize.md) before creating the image version.
232+
233+
```azurecli-interactive
234+
az sig image-version create --resource-group MyResourceGroup \
235+
--gallery-name MyGallery --gallery-image-definition MyImageDef \
236+
--gallery-image-version 1.0.0 \
237+
--managed-image /subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM
238+
```
239+
240+
In case a managed disk or a managed disk snapshot needs to be used as the image source for the image version, replace the --managed-image in the above command with --os-snapshot and provide the disk or the snapshot resource name
241+
242+
Create a Trusted Launch VM from the above image version
243+
244+
```azurecli-interactive
245+
adminUsername=linuxvm
246+
az vm create --resource-group MyResourceGroup \
247+
--name myTrustedLaunchVM \
248+
--image "/subscriptions/00000000-0000-0000-0000-00000000xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/galleries/MyGallery/images/MyImageDef" \
249+
--security-type TrustedLaunch \
250+
--enable-secure-boot true \
251+
--enable-vtpm true \
252+
--admin-username $adminUsername \
253+
--generate-ssh-keys
254+
```
255+
256+
### [PowerShell](#tab/powershell2)
257+
258+
Create an image definition with `TrustedLaunch` security type
259+
260+
```azurepowershell-interactive
261+
$rgName = "MyResourceGroup"
262+
$galleryName = "MyGallery"
263+
$galleryImageDefinitionName = "MyImageDef"
264+
$location = "eastus"
265+
$publisherName = "TrustedlaunchPublisher"
266+
$offerName = "TrustedlaunchOffer"
267+
$skuName = "TrustedlaunchSku"
268+
$description = "My gallery"
269+
$SecurityType = @{Name='SecurityType';Value='TrustedLaunch'}
270+
$features = @($SecurityType)
271+
New-AzGalleryImageDefinition -ResourceGroupName $rgName -GalleryName $galleryName -Name $galleryImageDefinitionName -Location $location -Publisher $publisherName -Offer $offerName -Sku $skuName -HyperVGeneration "V2" -OsState "Generalized" -OsType "Windows" -Description $description -Feature $features
272+
```
273+
274+
To create an image version, we can capture an existing Windows based Trusted launch VM. [Generalize the Trusted launch VM](generalize.md) before creating the image version.
275+
276+
```azurepowershell-interactive
277+
$rgName = "MyResourceGroup"
278+
$galleryName = "MyGallery"
279+
$galleryImageDefinitionName = "MyImageDef"
280+
$location = "eastus"
281+
$galleryImageVersionName = "1.0.0"
282+
$sourceImageId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myVMRG/providers/Microsoft.Compute/virtualMachines/myVM"
283+
New-AzGalleryImageVersion -ResourceGroupName $rgName -GalleryName $galleryName -GalleryImageDefinitionName $galleryImageDefinitionName -Name $galleryImageVersionName -Location $location -SourceImageId $sourceImageId
284+
```
285+
Create a Trusted Launch VM from the above image version
286+
287+
```azurepowershell-interactive
288+
$rgName = "MyResourceGroup"
289+
$galleryName = "MyGallery"
290+
$galleryImageDefinitionName = "MyImageDef"
291+
$location = "eastus"
292+
$vmName = "myVMfromImage"
293+
$vmSize = "Standard_D2s_v3"
294+
$imageDefinition = Get-AzGalleryImageDefinition `
295+
-GalleryName $galleryName `
296+
-ResourceGroupName $rgName `
297+
-Name $galleryImageDefinitionName
298+
$cred = Get-Credential `
299+
-Message "Enter a username and password for the virtual machine"
300+
# Network pieces
301+
$subnetConfig = New-AzVirtualNetworkSubnetConfig `
302+
-Name mySubnet `
303+
-AddressPrefix 192.168.1.0/24
304+
$vnet = New-AzVirtualNetwork `
305+
-ResourceGroupName $rgName `
306+
-Location $location `
307+
-Name MYvNET `
308+
-AddressPrefix 192.168.0.0/16 `
309+
-Subnet $subnetConfig
310+
$pip = New-AzPublicIpAddress `
311+
-ResourceGroupName $rgName `
312+
-Location $location `
313+
-Name "mypublicdns$(Get-Random)" `
314+
-AllocationMethod Static `
315+
-IdleTimeoutInMinutes 4
316+
$nsgRuleRDP = New-AzNetworkSecurityRuleConfig `
317+
-Name myNetworkSecurityGroupRuleRDP `
318+
-Protocol Tcp `
319+
-Direction Inbound `
320+
-Priority 1000 `
321+
-SourceAddressPrefix * `
322+
-SourcePortRange * `
323+
-DestinationAddressPrefix * `
324+
-DestinationPortRange 3389 `
325+
-Access Deny
326+
$nsg = New-AzNetworkSecurityGroup `
327+
-ResourceGroupName $rgName `
328+
-Location $location `
329+
-Name myNetworkSecurityGroup `
330+
-SecurityRules $nsgRuleRDP
331+
$nic = New-AzNetworkInterface `
332+
-Name myNic `
333+
-ResourceGroupName $rgName `
334+
-Location $location `
335+
-SubnetId $vnet.Subnets[0].Id `
336+
-PublicIpAddressId $pip.Id `
337+
-NetworkSecurityGroupId $nsg.Id
338+
$vm = New-AzVMConfig -vmName $vmName -vmSize $vmSize | `
339+
Set-AzVMOperatingSystem -Windows -ComputerName $vmName -Credential $cred | `
340+
Set-AzVMSourceImage -Id $imageDefinition.Id | `
341+
Add-AzVMNetworkInterface -Id $nic.Id
342+
$vm = Set-AzVMSecurityProfile -SecurityType "TrustedLaunch" -VM $vm
343+
$vm = Set-AzVmUefi -VM $vm `
344+
-EnableVtpm $true `
345+
-EnableSecureBoot $true
346+
New-AzVM `
347+
-ResourceGroupName $rgName `
348+
-Location $location `
349+
-VM $vm
350+
```
351+
---
352+
353+
### Trusted Launch VM Supported Images
354+
355+
For the following image sources, the security type on the image definition should be set to `Trustedlaunchsupported` as the image source does not have VM Guest state information:
356+
- Gen2 OS Disk VHD
357+
- Gen2 Managed Image
358+
- Gen2 Gallery Image Version
359+
360+
The resulting image version can be used to create either Azure Gen2 VMs or Trusted launch VMs.
361+
362+
These images can be shared to everyone through [Azure Compute Gallery - Community Gallery](https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery#community-gallery) and to specific subscriptions or tenants through [Azure Compute Gallery - Direct Shared Gallery](https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery#shared-directly-to-a-tenant-or-subscription)
363+
364+
> [!NOTE]
365+
> The OS disk VHD, Managed Image or Gallery Image Version should be created from an image that is compatible with Trusted launch VMs.
366+
367+
#### [Portal](#tab/portal2)
160368

161369
1. Sign in to the Azure [portal](https://portal.azure.com).
162370
2. To create an Azure Compute Gallery Image from a VM, open an existing Trusted launch VM and select **Capture**.
@@ -335,6 +543,7 @@ New-AzVM `
335543
-VM $vm
336544
```
337545
---
546+
338547
## Verify or update your settings
339548

340549
For VMs created with trusted launch enabled, you can view the trusted launch configuration by visiting the **Overview** page for the VM in the portal. The **Properties** tab will show the status of Trusted Launch features:

0 commit comments

Comments
 (0)