DiskEncryption/EnableEncryptionOnRunningLinuxVM-Format-AADClientSecret.json at master · aravindthoram/DiskEncryption · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "vmName": {
      "type": "string",
      "metadata": {
        "Description": "Name of the virtual machine"
      }
    },
    "AADClientID": {
      "type": "string",
      "metadata": {
        "Description": "Client ID of AAD app which has permissions to KeyVault"
      }
    },
    "AADClientSecret": {
      "type": "securestring",
      "metadata": {
        "Description": "Client Secret of AAD app which has permissions to KeyVault"
      }
    },
    "KeyVaultResourceID": {
      "type": "string",
      "metadata": {
        "Description": "ResourceID of the KeyVault to place the volume encryption key"
      }
    },
    "KeyVaultURL": {
      "type": "string",
      "metadata": {
        "Description": "URL of the KeyVault to place the volume encryption key"
      }
    },
    "VolumeType": {
      "type": "string",
      "defaultValue": "Data",
      "metadata": {
        "Description": "Type of the volume OS or Data to perform encryption operation"
      }
    },
    "osDiskName": {
      "type": "string",
      "metadata": {
        "Description": "name of the OS disk on which encryption needs to be enabled"
      }
    },
    "sequenceVersion": {
      "type": "string",
      "defaultValue": "1",
      "metadata": {
        "Description": "sequence version of the bitlocker operation. Increment this everytime an operation is performed on the same VM"
      }
    },
    "diskFormatQuery": {
      "type": "string",
      "metadata": {
        "Description": "the query string used to identify the disks to format and encrypt."
      }
    },
    "Passphrase": {
    "type": "securestring",
    "defaultValue": "",
      "metadata": {
        "Description": "the passphrase specified."
      }
    }
  },
  "variables": {
    "extensionName": "AzureDiskEncryptionForLinux",
    "extensionVersion": "0.1",
    "encryptionOperation": "EnableEncryptionFormat"
  },
  "resources": [
    {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "name": "[concat(parameters('vmName'),'/', variables('extensionName'))]",
      "apiVersion": "2015-06-15",
      "location": "[resourceGroup().location]",
      "properties": {
        "publisher": "Microsoft.OSTCExtensions",
        "type": "AzureDiskEncryptionForLinux",
        "typeHandlerVersion": "[variables('extensionVersion')]",
        "settings": {
          "AADClientID": "[parameters('AADClientID')]",
          "KeyVaultURL": "[parameters('KeyVaultURL')]",
          "VolumeType": "[parameters('VolumeType')]",
          "EncryptionOperation": "[variables('encryptionOperation')]",
          "SequenceVersion": "[parameters('sequenceVersion')]",
          "DiskFormatQuery": "[parameters('diskFormatQuery')]"
        },
        "protectedSettings": {
          "AADClientSecret": "[parameters('AADClientSecret')]",
          "Passphrase": "[parameters('Passphrase')]"
        }
      }
    },
    {
      "apiVersion": "2015-06-15",
      "type": "Microsoft.Compute/virtualMachines",
      "name": "[parameters('vmName')]",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "[resourceId('Microsoft.Compute/virtualMachines/extensions',  parameters('vmName'), variables('extensionName'))]"
      ],
      "properties": {
        "storageProfile": {
          "osDisk": {
            "name": "[parameters('osDiskName')]",
            "encryptionSettings": {
              "diskEncryptionKey": {
                "sourceVault": {
                  "id": "[parameters('KeyVaultResourceID')]"
                },
                "secretUrl": "[reference(resourceId('Microsoft.Compute/virtualMachines/extensions',  parameters('vmName'), variables('extensionName'))).instanceView.statuses[0].message]"
              }
            }
          }
        }
      }
    }
  ],
  "outputs": {
    "BitLockerKey": {
      "type": "string",
      "value": "[reference(resourceId('Microsoft.Compute/virtualMachines/extensions',  parameters('vmName'), variables('extensionName'))).instanceView.statuses[0].message]"
    }
  }
}