Python Azure sdk - Enabling Disk Encryption

Question

while scouring the stackoverflown and github for any information about - "How can one go about using python to encrypt all disks in his/her subscription"?

What I found eventually is THIS, but what actually messes me up is how does one go about importing such a class? IF it needs importing at all.

This is what I have tried so far.

To list all vm's

from azure.common.credentials import ServicePrincipalCredentials
credentials = ServicePrincipalCredentials(
client_id = CLIENT,
secret = KEY,
tenant = TENANT_ID)

compute_client = ComputeManagementClient(credentials, subscription_id) # Variables are provided before, along with the data that fills the credentials Dict.

for vm in compute_client.virtual_machines.list_all():
    print("\tVM: {}".format(vm.name))

So this brings me to my issue. Now that i have the "vm" object i should be able to pull all the necessary information (in theory) to finish my task.

But how on earth do i go around using the DiskEncryptionSetsOperations class? Do i initialize it? Do i import it?

Could you please tell me which type of Vm you use?

Jim Xu
– Jim Xu

2020-01-20 03:14:12 +00:00
Commented Jan 20, 2020 at 3:14 — Jim Xu
– Jim Xu, Commented Jan 20, 2020 at 3:14

Jim Xu · Accepted Answer · 2020-01-20 07:08:13Z

Regarding how to encrypt Azure VM disk, please refer to the following steps

az login

az keyvault create --name 'testdisk' --resource-group 'testvm1' --location 'centralus' --enabled-for-disk-encryption true --enabled-for-deployment true --enabled-for-template-deployment true
az keyvault key create --name diskery --vault-name testdisk --kty RSA

Code

import uuid
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.compute.models import VirtualMachineExtension
from msrestazure.tools import parse_resource_id

AZURE_TENANT_ID= ''
AZURE_CLIENT_ID=''
AZURE_CLIENT_SECRET='' 
AZURE_SUBSCRIPTION_ID=''

credentials = ServicePrincipalCredentials(client_id=AZURE_CLIENT_ID,secret=AZURE_CLIENT_SECRET,tenant=AZURE_TENANT_ID)
compute_client = ComputeManagementClient(credentials, AZURE_SUBSCRIPTION_ID)
resource_group_name='testvm1'
vm_name='test03'
vm =compute_client.virtual_machines.get(resource_group_name,vm_name)
parts = parse_resource_id(vm.id)
KeyVaultResourceId='/subscriptions/<your subscription id>/resourceGroups/<group name>/providers/Microsoft.KeyVault/vaults/<your key vault name>'
KeyEncryptionKeyURL='https://<your key vault name>.vault.azure.net/keys/<name>/<version>'
KeyVaultURL='https://<your key vault name>.vault.azure.net/'

# we are ready to provision/update the disk encryption extensions
os_type = vm.storage_profile.os_disk.os_type.value 
sequence_version = uuid.uuid4()
public_settings={"EncryptionOperation": 'EnableEncryption',
          "KeyVaultURL": KeyVaultURL,
          "KeyVaultResourceId": KeyVaultResourceId,
          "KeyEncryptionKeyURL": KeyEncryptionKeyURL,
          "KekVaultResourceId": KeyVaultResourceId,
          "KeyEncryptionAlgorithm": 'RSA-OAEP',
          "VolumeType": 'ALL',
          'SequenceVersion': sequence_version,
        }

if(os_type.lower() =='windows') :
    ext= VirtualMachineExtension(
           location=vm.location,
           publisher='Microsoft.Azure.Security',
           virtual_machine_extension_type='AzureDiskEncryption',
           type_handler_version='2.2',
           auto_upgrade_minor_version=True,
           settings=public_settings,
           protected_settings=None



    )
    poller  =compute_client.virtual_machine_extensions.create_or_update(parts['resource_group'],parts['name'],'test',ext)

else :
    ext= VirtualMachineExtension(
           location=vm.location,
           publisher='Microsoft.Azure.Security',
           virtual_machine_extension_type='AzureDiskEncryptionForLinux',
           type_handler_version='1.1',
           auto_upgrade_minor_version=True,
           settings=public_settings,
           protected_settings=None



    )
    poller  =compute_client.virtual_machine_extensions.create_or_update(parts['resource_group'],parts['name'],'test',ext)



# verify the extension was ok
extension_result = compute_client.virtual_machine_extensions.get(
        parts['resource_group'],parts['name'],'test', 'instanceView')
if extension_result.provisioning_state != 'Succeeded':
    print('Extension needed for disk encryption was not provisioned correctly')
print("success")

For more details, please refer to

https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/azure-disk-enc-windows

https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-disk-encryption-vms-vmss

Collectives™ on Stack Overflow

Python Azure sdk - Enabling Disk Encryption

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related