Azure Disk Encryption + Linux VM = ??

Just a quick script to automate creating a linux VM and excrypting it. Requires you to be logged with proper rights (to create all the things and access KeyVault)

$appName = 'appName'
$appPwd = '!Q2w3e4r5t6y'
$bogusHttp = 'http://localhost/test'
$location = 'northeurope'

$app = New-AzureRmADApplication -DisplayName $appname -HomePage $bogusHttp -IdentifierUris $bogusHttp -Password $appPwd
New-AzureRmADServicePrincipal -ApplicationId $app.ApplicationId

$rg = New-AzureRmResourceGroup -Name $appName -Location $location
$kv = New-AzureRmKeyVault -VaultName $appName -ResourceGroupName $rg.ResourceGroupName -Location $location -Sku Premium -EnabledForDiskEncryption:$true
#New-AzureRmRecoveryServicesVault -Name $appName -ResourceGroupName $rg.ResourceGroupName -Location $location

Set-AzureRmKeyVaultAccessPolicy -VaultName $kv.VaultName -ResourceGroupName $rg.ResourceGroupName -ServicePrincipalName $app.ApplicationId -PermissionsToKeys wrapKey -PermissionsToSecrets set

$kek = Add-AzureKeyVaultKey -VaultName $kv.VaultName -Name 'kek' -Destination HSM

$aesProvider = New-Object System.Security.Cryptography.AesCryptoServiceProvider
$aesProvider.KeySize = 256
$base64Array = [Convert]::ToBase64String($aesProvider.Key)

$vmParams = @{
    adminUsername  = 'testo'
    adminPassword  = (ConvertTo-SecureString -AsPlainText -Force $appPwd)
    dnsLabelPrefix = 'qscwdvzsexdr'

$params = @{
    aadClientId = $app.ApplicationId
    aadClientSecret = (ConvertTo-SecureString -AsPlainText -Force $appPwd)
    VolumeType = 'OS'
    keyEncryptionKeyURL = $kek.key.kid
    keyVaultName = $kv.VaultName
    keyVaultResourceGroup = $kv.VaultName
    passphrase = (ConvertTo-SecureString -AsPlainText -Force $base64Array)
    usekek = 'kek'
    vmname = 'MyUbuntuVM'

# this does create a A1 VM, so its no going to work, but I'm using my own template here, just use any way to create a VM with more than 2 cores\4 gb RAM
New-AzureRMResourceGroupDeployment -Name $appName -ResourceGroupName $rg.ResourceGroupName -TemplateUri @vmParams

New-AzureRmResourceGroupDeployment -Name $appName -ResourceGroupName $rg.ResourceGroupName -TemplateUri @params


Written on March 12, 2017