Azure 磁盘加密 - 通过带有密钥保管库的 Terraform - VmExtensionProvisioningError

Posted 2023-03-17

【中文标题】Azure 磁盘加密 - 通过带有密钥保管库的 Terraform - VmExtensionProvisioningError

【英文标题】：Azure Disk Encryption - via Terraform with Key vault - VmExtensionProvisioningError

【发布时间】：2021-01-16 09:06:51

【问题描述】：

我正在尝试使用密钥保管库中的密钥使用 terraform 加密磁盘。 但是我得到以下错误：

[2.2.0.33] Failed to configure bitlocker as expected. Exception: Value cannot be null. Parameter name: resIdString, InnerException: , stack trace: at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.Settings.BitlockerExtensionSettings.ValidateKeyVaultResourceId(String resIdString) in X:\bt\1122012\repo\src\BitLocker\BitlockerIaasVMExtension\Settings\BitlockerExtensionSettings.cs:line 119 at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.Settings.BitlockerExtensionSettings.GetExtensionPublicSettings() in X:\bt\1122012\repo\src\BitLocker\BitlockerIaasVMExtension\Settings\BitlockerExtensionSettings.cs:line 143 at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.BitlockerExtension.InitializeExtension() in X:\bt\1122012\repo\src\BitLocker\BitlockerIaasVMExtension\BitlockerExtension.cs:line 1865 at Microsoft.Cis.Security.BitLocker.BitlockerIaasVMExtension.BitlockerExtension.OnEnable() in X:\bt\1122012\repo\src\BitLocker\BitlockerIaasVMExtension\BitlockerExtension.cs:line 1919

【问题讨论】：

可以贴一个实际的代码，而不是代码的截图吗？

【参考方案1】：

如果要为 Azure 磁盘加密配置密钥保管库，请参考以下步骤。更多详情请参考here

创建服务主体并分配

az login
az account set --subscription "SUBSCRIPTION_ID"
az ad sp create-for-rbac --role "Contributor" --scopes "/subscriptions/<subscription_id>"

我的变量文件

variable "resource_group_name" 
  description = "Default resource group name that the network will be created in"
  default     = ""


variable "location" 
  description = "The location/region where the core network will be created. The full list of Azure regions can be found at https://azure.microsoft.com/regions"
  default     = "East Asia"


variable key_vault_name 
  description = "Name of the keyVault"
  default     = "hurykeyv"


variable virtual_machine_id 
    description = "the resource id of the vm"
    default     = ""

variable encryption_algorithm 
  description = " Algo for encryption"
  default     = "RSA-OAEP"


variable "volume_type" 
  default = "All"


variable "encrypt_operation" 
  default = "EnableEncryption"


variable "type_handler_version" 
  description = "Type handler version of the VM extension to use. Defaults to 2.2 on Windows and 1.1 on Linux"
  default     = "2.2"

我的脚本文件

provider "azurerm" 

    version = "~>2.0"
        subscription_id = ""
        client_id = "sp appId"
        client_secret = "sp password"
        tenant_id = "sp tenant"
        features 


resource "random_string" "password" 
  length  = 16
  special = false


data "azurerm_resource_group" "test" 
  name = var.resource_group_name


resource "azurerm_key_vault" "keyvault" 
  name                = var.key_vault_name
  resource_group_name = var.resource_group_name
   enabled_for_disk_encryption = true
   enabled_for_deployment=true
   enabled_for_template_deployment =true
   location=data.azurerm_resource_group.test.location
   sku_name = "standard"
   tenant_id=data.azurerm_client_config.current.tenant_id
   soft_delete_enabled=true
   soft_delete_retention_days=90
   


resource "azurerm_key_vault_access_policy" "myPolicy" 
  key_vault_id = azurerm_key_vault.keyvault.id

  tenant_id = data.azurerm_client_config.current.tenant_id
  object_id = data.azurerm_client_config.current.object_id
  
  key_permissions = [
    "get",
    "create",
    "delete"
  ]


resource "azurerm_key_vault_key" "testKEK" 
  name         = "testKEK"
  key_vault_id = azurerm_key_vault.keyvault.id
  key_type     = "RSA"
  key_size     = 2048
   depends_on = [
    azurerm_key_vault_access_policy.myPolicy
  ]
  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]

 
resource "azurerm_virtual_machine_extension" "vmextension" 
  name                       = random_string.password.result
  virtual_machine_id         = var.virtual_machine_id
  publisher                  = "Microsoft.Azure.Security"
  type                       = "AzureDiskEncryption"
  type_handler_version       = var.type_handler_version
  auto_upgrade_minor_version = true

  settings = <<SETTINGS
    
        "EncryptionOperation": "$var.encrypt_operation",
        "KeyVaultURL": "$azurerm_key_vault.keyvault.vault_uri",
        "KeyVaultResourceId": "$azurerm_key_vault.keyvault.id",                   
        "KeyEncryptionKeyURL": "$azurerm_key_vault_key.testKEK.id",
        "KekVaultResourceId": "$azurerm_key_vault.keyvault.id",                   
        "KeyEncryptionAlgorithm": "$var.encryption_algorithm",
        "VolumeType": "$var.volume_type"
    
SETTINGS

  

【讨论】：

@RUser 您还有其他顾虑吗？如果您没有其他顾虑，请您接受它作为回答者吗？

我仍然有同样的问题。我没有使用来自市场的图像。这是一个强化的图像 - 可能是某些注册表/GPO 设置导致了问题。你对此有什么想法吗？

@RUser 根据报错信息，好像你没有提供值。您能否参考文档：docs.microsoft.com/en-us/azure/virtual-machines/extensions/… 来检查您的脚本？

看来，D4sV4 不支持 ADE。 Microsoft 团队要求寻找 D4sV3 或其他 SKU VM 以获得 ADE 支持