Skip to content

Commit b907161

Browse files
v-sissondanv-sissondan
committed
incorp Ram feedback
1 parent 1a46601 commit b907161

File tree

1 file changed

+75
-11
lines changed

1 file changed

+75
-11
lines changed

‎azure-local/manage/trusted-launch-vm-import-key.md

Lines changed: 75 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.author: alkohli
66
ms.topic: how-to
77
ms.service: azure-local
88
ms.reviewer: alkohli
9-
ms.date: 07/21/2025
9+
ms.date: 07/23/2025
1010
---
1111

1212
# Manual backup and recovery of guest state protection keys for Trusted launch Azure Local VMs enabled by Azure Arc
@@ -59,34 +59,48 @@ The steps below involve copying VM guest state protection keys from the local ke
5959
6060
Backup-TVMKeys -WrappingKeyPath <path to public.pem> -BackupRootPath <path to backup root folder where the timestamped backup folder is stored>
6161
```
62+
Here is a sample output after running this command:
6263
63-
1. Make note of the timestamped backup folder created under the backup root folder. You'll need this later during recovery. For example, backup folder named "20250612205355" with the format "yyyyMMddHHmmss".
64+
```output
65+
Backing up TVM Vault keys to .\<backup root folder>\20250722192116
66+
Backing up key 11111111-1111-1111-1111-111111111111 to AES folder
67+
Backing up key 7fb16fe7-00a0-476f-92b3-ccb98fd9525a to AES folder
68+
Backing up key AzureStackTvmAKRootKey to RSA folder
69+
```
6470
65-
1. Anytime you create a new VM on Azure Local instance, run the script and back up the keys in the key vault.
71+
1. Make note of the timestamped backup folder created under the backup root folder. You'll need this later during recovery. For example, backup folder named "20250612205355" with the format "yyyyMMddHHmmss".
6672
6773
### Restore keys
6874
6975
The steps below involve restoring VM guest state protection keys from a folder containing the backup copy to the key vault of an Azure Local instance where the VMs need to be restored.
7076
7177
1. Copy both private and public key files for the wrapping key that you created previously to the Azure Local instance.
7278
73-
1. Copy the timestamped backup folder to the Azure Local instance. Pick the folder under the backup root folder with the latest timestamp as that folder will have the most recent copy.
74-
75-
> [!NOTE]
76-
> Don't modify the backup folder.
79+
1. Copy the timestamped backup folder to the Azure Local instance. Pick the folder under the backup root folder with the latest timestamp as that folder will have the most recent copy. Don't modify the backup folder.
7780
7881
1. Import the wrapping key that you created previously to the Azure Local instance:
7982
8083
1. Download the [TvmBackupUtils.psm1 script](https://github.com/Azure-Samples/AzureLocal/blob/main/trusted-launch-vms/TvmBackupUtils.psm1) on GitHub to your Azure Local instance.
8184
82-
1. Run the following commands. Make sure to create a unique name for the WrappingKeyName. Otherwise, this will cause a failure during import:
85+
1. Run the following commands.
86+
87+
> [!NOTE]
88+
> Make sure to create a unique name for the WrappingKeyName. Otherwise, this will cause a failure during import:
8389
8490
```powershell
8591
Import-Module .\TvmBackupUtils.psm1 -force
8692
8793
Import-TvmWrappingKeyFromPem -KeyName <WrappingKeyName> -PublicKeyPath <path to public.pem> -PrivateKeyPath <path to private.pem> -KeySize 2048
8894
```
89-
95+
Here is sample output:
96+
97+
```output
98+
Generating import JSON for key <WrappingKeyName> at temporary location C:\Users\HCIDeploymentUser\AppData\Local\Temp\tmpD383.tmp...
99+
Importing key <WrappingKeyName> into the vault...
100+
Key <WrappingKeyName> successfully imported into the vault.
101+
Temporary file C:\Users\HCIDeploymentUser\AppData\Local\Temp\tmpD383.tmp has been cleaned up.
102+
```
103+
90104
1. Do this step only if you're restoring the VM to the same Azure Local instance where the VM resided before failure. Delete `AzureStackTvmAKRootKey` as follows:
91105
92106
```powershell
@@ -98,9 +112,57 @@ The steps below involve restoring VM guest state protection keys from a folder c
98112
```powershell
99113
Import-TVMKeys -WrappingKeyName <WrappingKeyName> -BackupPath <path to timestamped backup folder>
100114
```
115+
Here is sample output:
116+
117+
```output
118+
Importing TVM keys from .\tvm_keys_backup_root\20250722192116\
119+
120+
Importing key 11111111-1111-1111-1111-111111111111 with size 256 from AES folder path = .\tvm_keys_backup_root\20250722192116\AES\11111111-1111-1111-1111-111111111111_256.json
121+
122+
Importing key 7fb16fe7-00a0-476f-92b3-ccb98fd9525a with size 256 from AES folder path = .\tvm_keys_backup_root\20250722192116\AES\7fb16fe7-00a0-476f-92b3-ccb98fd9525a_256.json
123+
124+
Importing key AzureStackTvmAKRootKey with size 4096 from RSA folder path = .\tvm_keys_backup_root\20250722192116\RSA\AzureStackTvmAKRootKey_4096.json
125+
```
101126
102127
If the local key vault of the Azure Local instance already has a VM guest state protection key with the same name or already has an `AzureStackTvmAKRootKey`, you'll receive an `InvalidVersion` error for that key. You can ignore this, as the key is already in the key vault.
103128
129+
Here is sample output showing this error:
130+
131+
```output
132+
Importing TVM keys from .\tvm_keys_backup_root\20250722192116\
133+
Importing key 11111111-1111-1111-1111-111111111111 with size 256 from AES folder path = .\tvm_keys_backup_root\20250722192116\AES\11111111-1111-1111-1111-111111111111_256.json
134+
Import-TVMKeys : Error Importing Key: C:\Program Files\AksHci\mocctl.exe --cloudFqdn
135+
s-cluster.v.masd.stbtest.microsoft.com security keyvault key import --group "AzureStackHostAttestation" --key-size
136+
"256" --vault-name "AzureStackTvmKeyVault" --key-type "AES" --key-file-path
137+
".\tvm_keys_backup_root\20250722192116\AES\11111111-1111-1111-1111-111111111111_256.json" --name
138+
"11111111-1111-1111-1111-111111111111" --wrapping-key-name "WrappingKey" System.Collections.Hashtable.generic_non_zero
139+
1 [Error: Keys Import failed: Type[Key] Vault[AzureStackTvmKeyVault] Name[11111111-1111-1111-1111-111111111111]:
140+
InvalidVersion]
141+
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
142+
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Import-TVMKeys
143+
144+
Importing key 7fb16fe7-00a0-476f-92b3-ccb98fd9525a with size 256 from AES folder path = .\tvm_keys_backup_root\20250722192116\AES\7fb16fe7-00a0-476f-92b3-ccb98fd9525a_256.json
145+
Import-TVMKeys : Error Importing Key: C:\Program Files\AksHci\mocctl.exe --cloudFqdn
146+
s-cluster.v.masd.stbtest.microsoft.com security keyvault key import --group "AzureStackHostAttestation" --key-size
147+
"256" --vault-name "AzureStackTvmKeyVault" --key-type "AES" --key-file-path
148+
".\tvm_keys_backup_root\20250722192116\AES\7fb16fe7-00a0-476f-92b3-ccb98fd9525a_256.json" --name
149+
"7fb16fe7-00a0-476f-92b3-ccb98fd9525a" --wrapping-key-name "WrappingKey" System.Collections.Hashtable.generic_non_zero
150+
1 [Error: Keys Import failed: Type[Key] Vault[AzureStackTvmKeyVault] Name[7fb16fe7-00a0-476f-92b3-ccb98fd9525a]:
151+
InvalidVersion]
152+
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
153+
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Import-TVMKeys
154+
155+
Importing key AzureStackTvmAKRootKey with size 4096 from RSA folder path = .\tvm_keys_backup_root\20250722192116\RSA\AzureStackTvmAKRootKey_4096.json
156+
Import-TVMKeys : Error Importing Key: C:\Program Files\AksHci\mocctl.exe --cloudFqdn
157+
s-cluster.v.masd.stbtest.microsoft.com security keyvault key import --group "AzureStackHostAttestation" --key-size
158+
"4096" --vault-name "AzureStackTvmKeyVault" --key-type "RSA" --key-file-path
159+
".\tvm_keys_backup_root\20250722192116\RSA\AzureStackTvmAKRootKey_4096.json" --name "AzureStackTvmAKRootKey"
160+
--wrapping-key-name "WrappingKey" System.Collections.Hashtable.generic_non_zero 1 [Error: Keys Import failed:
161+
Type[Key] Vault[AzureStackTvmKeyVault] Name[AzureStackTvmAKRootKey]: InvalidVersion]
162+
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
163+
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Import-TVMKeys
164+
```
165+
104166
1. Clean up files and keys:
105167
106168
1. Delete both `public.pem` and `private.pem` files from the Azure Local instance.
@@ -211,12 +273,14 @@ Follow these steps to copy the VM guest state protection key. The key is copied
211273
212274
1. Import the VM guest state protection key:
213275
276+
```powershell
277+
Import-MocKey -name <VM ID> -importKeyFile <VM ID>.json -group AzureStackHostAttestation -keyvaultName AzureStackTvmKeyVault -type AES -size 256
278+
```
279+
214280
> [!NOTE]
215281
> Restore the VM guest state key (complete the preceding steps) before you start the VM on the Azure Local instance where the VM needs to be restored. This ensures that the VM uses the restored VM guest state protection key. Otherwise, the VM creation fails, and a new VM guest state protection key is created by the system. If this happens by mistake (human error), delete the VM guest state protection key and then repeat the steps to restore the VM guest state protection key.
216282
217283
```powershell
218-
Import-MocKey -name <VM ID> -importKeyFile <VM ID>.json -group AzureStackHostAttestation -keyvaultName AzureStackTvmKeyVault -type AES -size 256
219-
220284
Remove-MocKey -name <vm id> -group AzureStackHostAttestation -keyvaultName AzureStackTvmKeyVault
221285
```
222286

0 commit comments

Comments
 (0)