Set-AzVMOSDisk

Sintaxe

Set-AzVMOSDisk
   [-VM] <PSVirtualMachine>
   [[-Name] <String>]
   [[-VhdUri] <String>]
   [[-Caching] <CachingTypes>]
   [[-SourceImageUri] <String>]
   [[-CreateOption] <String>]
   [-DiskSizeInGB <Int32>]
   [-ManagedDiskId <String>]
   [-StorageAccountType <String>]
   [-DiskEncryptionSetId <String>]
   [-WriteAccelerator]
   [-DiffDiskSetting <String>]
   [-DiffDiskPlacement <String>]
   [-DeleteOption <String>]
   [-SecurityEncryptionType <String>]
   [-SecureVMDiskEncryptionSet <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Set-AzVMOSDisk
   [-VM] <PSVirtualMachine>
   [[-Name] <String>]
   [[-VhdUri] <String>]
   [[-Caching] <CachingTypes>]
   [[-SourceImageUri] <String>]
   [[-CreateOption] <String>]
   [-Windows]
   [-DiskSizeInGB <Int32>]
   [-ManagedDiskId <String>]
   [-StorageAccountType <String>]
   [-DiskEncryptionSetId <String>]
   [-WriteAccelerator]
   [-DiffDiskSetting <String>]
   [-DiffDiskPlacement <String>]
   [-DeleteOption <String>]
   [-SecurityEncryptionType <String>]
   [-SecureVMDiskEncryptionSet <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Set-AzVMOSDisk
   [-VM] <PSVirtualMachine>
   [[-Name] <String>]
   [[-VhdUri] <String>]
   [[-Caching] <CachingTypes>]
   [[-SourceImageUri] <String>]
   [[-CreateOption] <String>]
   [-Windows]
   [-DiskEncryptionKeyUrl] <String>
   [-DiskEncryptionKeyVaultId] <String>
   [[-KeyEncryptionKeyUrl] <String>]
   [[-KeyEncryptionKeyVaultId] <String>]
   [-DiskSizeInGB <Int32>]
   [-ManagedDiskId <String>]
   [-StorageAccountType <String>]
   [-DiskEncryptionSetId <String>]
   [-WriteAccelerator]
   [-DiffDiskSetting <String>]
   [-DiffDiskPlacement <String>]
   [-DeleteOption <String>]
   [-SecurityEncryptionType <String>]
   [-SecureVMDiskEncryptionSet <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Set-AzVMOSDisk
   [-VM] <PSVirtualMachine>
   [[-Name] <String>]
   [[-VhdUri] <String>]
   [[-Caching] <CachingTypes>]
   [[-SourceImageUri] <String>]
   [[-CreateOption] <String>]
   [-Linux]
   [-DiskSizeInGB <Int32>]
   [-ManagedDiskId <String>]
   [-StorageAccountType <String>]
   [-DiskEncryptionSetId <String>]
   [-WriteAccelerator]
   [-DiffDiskSetting <String>]
   [-DiffDiskPlacement <String>]
   [-DeleteOption <String>]
   [-SecurityEncryptionType <String>]
   [-SecureVMDiskEncryptionSet <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Set-AzVMOSDisk
   [-VM] <PSVirtualMachine>
   [[-Name] <String>]
   [[-VhdUri] <String>]
   [[-Caching] <CachingTypes>]
   [[-SourceImageUri] <String>]
   [[-CreateOption] <String>]
   [-Linux]
   [-DiskEncryptionKeyUrl] <String>
   [-DiskEncryptionKeyVaultId] <String>
   [[-KeyEncryptionKeyUrl] <String>]
   [[-KeyEncryptionKeyVaultId] <String>]
   [-DiskSizeInGB <Int32>]
   [-ManagedDiskId <String>]
   [-StorageAccountType <String>]
   [-DiskEncryptionSetId <String>]
   [-WriteAccelerator]
   [-DiffDiskSetting <String>]
   [-DiffDiskPlacement <String>]
   [-DeleteOption <String>]
   [-SecurityEncryptionType <String>]
   [-SecureVMDiskEncryptionSet <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Description

O cmdlet Set-AzVMOSDisk define as propriedades do disco do sistema operacional em uma máquina virtual.

Exemplos

Exemplo 1: Definir propriedades em uma máquina virtual a partir da imagem da plataforma

$AvailabilitySet = Get-AzAvailabilitySet -ResourceGroupName "ResourceGroup11" -Name "AvailabilitySet13" 
$VirtualMachine = New-AzVMConfig -VMName "VirtualMachine17" -VMSize "Standard_A1" -AvailabilitySetID $AvailabilitySet.Id 
Set-AzVMOSDisk -VM $VirtualMachine -Name "OsDisk12" -VhdUri "os.vhd" -Caching ReadWrite
$VirtualMachine = Set-AzVMOperatingSystem -VM $VirtualMachine -Linux -ComputerName "MainComputer" -Credential (Get-Credential) 
$VirtualMachine = Set-AzVMSourceImage -VM $VirtualMachine -PublisherName "Canonical" -Offer "UbuntuServer" -Skus "15.10" -Version "latest"
$VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -Name "osDisk.vhd" -VhdUri "https://mystorageaccount.blob.core.windows.net/disks/" -CreateOption FromImage
New-AzVM -VM $VirtualMachine -ResourceGroupName "ResourceGroup11"

O primeiro comando obtém o conjunto de disponibilidade denominado AvailabilitySet13 no grupo de recursos chamado ResourceGroup11 e armazena esse objeto na variável $AvailabilitySet. O segundo comando cria um objeto de máquina virtual e o armazena na variável $VirtualMachine. O comando atribui um nome e um tamanho à máquina virtual. A máquina virtual pertence ao conjunto de disponibilidade armazenado em $AvailabilitySet. O comando final define as propriedades na máquina virtual em $VirtualMachine.

Exemplo 2: define propriedades em uma máquina virtual de imagem de usuário generalizada

$AvailabilitySet = Get-AzAvailabilitySet -ResourceGroupName "ResourceGroup11" -Name "AvailabilitySet13" 
$VirtualMachine = New-AzVMConfig -VMName "VirtualMachine17" -VMSize "Standard_A1"
$VirtualMachine = Set-AzVMOperatingSystem -VM $VirtualMachine -Linux -ComputerName "MainComputer" -Credential (Get-Credential)
$VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -Name "osDisk.vhd" -SourceImageUri "https://mystorageaccount.blob.core.windows.net/vhds/myOSImage.vhd" -VhdUri "https://mystorageaccount.blob.core.windows.net/disks/" -CreateOption fromImage -Linux
New-AzVM -VM $VirtualMachine -ResourceGroupName "ResourceGroup11"

O primeiro comando obtém o conjunto de disponibilidade denominado AvailabilitySet13 no grupo de recursos chamado ResourceGroup11 e armazena esse objeto na variável $AvailabilitySet. O segundo comando cria um objeto de máquina virtual e o armazena na variável $VirtualMachine. O comando atribui um nome e um tamanho à máquina virtual. A máquina virtual pertence ao conjunto de disponibilidade armazenado em $AvailabilitySet. O comando final define as propriedades na máquina virtual em $VirtualMachine.

Exemplo 3: define propriedades em uma máquina virtual a partir de uma imagem de usuário especializada

$AvailabilitySet = Get-AzAvailabilitySet -ResourceGroupName "ResourceGroup11" -Name "AvailabilitySet13" 
$VirtualMachine = New-AzVMConfig -VMName "VirtualMachine17" -VMSize "Standard_A1"
$VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -Name "osDisk.vhd" -VhdUri "https://mystorageaccount.blob.core.windows.net/disks/" -CreateOption Attach -Linux
New-AzVM -VM $VirtualMachine -ResourceGroupName "ResourceGroup11"

O primeiro comando obtém o conjunto de disponibilidade denominado AvailabilitySet13 no grupo de recursos chamado ResourceGroup11 e armazena esse objeto na variável $AvailabilitySet. O segundo comando cria um objeto de máquina virtual e o armazena na variável $VirtualMachine. O comando atribui um nome e um tamanho à máquina virtual. A máquina virtual pertence ao conjunto de disponibilidade armazenado em $AvailabilitySet. O comando final define as propriedades na máquina virtual em $VirtualMachine.

Exemplo 4: Definir as configurações de criptografia de disco em um disco do sistema operacional de máquina virtual

$VirtualMachine = New-AzVMConfig -VMName "VirtualMachine17" -VMSize "Standard_A1"
$VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -Name "OsDisk12" -VhdUri "os.vhd" -Caching ReadWrite -Windows -CreateOption "Attach" -DiskEncryptionKeyUrl "https://mytestvault.vault.azure.net/secrets/Test1/514ceb769c984379a7e0230bddaaaaaa" -DiskEncryptionKeyVaultId "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mytestvault"
New-AzVM -VM $VirtualMachine -ResourceGroupName " ResourceGroup11"

Este exemplo define as configurações de criptografia de disco em um disco do sistema operacional de máquina virtual.

Exemplo 5: Criar uma máquina virtual ConfidentialVM com criptografia de disco do so da VM de DiskWithVMGuestState e criptografia de conjunto de criptografia de disco de ConfidentialVmEncryptedWithCustomerKey.

$keyVaultName="your keyvault name"
$keyName="your key name"
$vmSize = "Standard_DC2as_v5";        
$identityType = "SystemAssigned";
$secureEncryptGuestState = "DiskWithVMGuestState";
$vmSecurityType = "ConfidentialVM";
$user = "your user name";
$desName = "your disk encryption set name";
$vmname = "your vm name";
$computerName = "your computer name"; 
$ResourceGroupName = 'your resource group name'
$Location = 'northeurope'

# Create Resource Group
New-AzResourceGroup -Name $ResourceGroupName -Location $Location -force;

#create a credential object
$securePassword = ConvertTo-SecureString -String "Password to your virtual machine here" -AsPlainText -Force; 
$cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);

# Create Key Vault
New-AzKeyVault -Name $keyVaultName -Location $Location -ResourceGroupName $ResourceGroupName -Sku Premium -EnabledForDiskEncryption -DisableRbacAuthorization -SoftDeleteRetentionInDays 10 -EnablePurgeProtection;

$cvmAgent = Get-AzADServicePrincipal -ApplicationId 'bf7b6499-ff71-4aa2-97a4-f372087be7f0'; #AppID of CVM Agent, this is a constant value but locate the SP ID for your tenant
Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ResourceGroupName $ResourceGroupName -ObjectId $cvmAgent.id -PermissionsToKeys get,release;

# Add Key vault Key
$KeyName = "keyname";
$KeySize = 3072;

Add-AzKeyVaultKey -VaultName $keyVaultName -Name $KeyName -Size $KeySize -KeyOps wrapKey,unwrapKey -KeyType RSA -Destination HSM -Exportable -UseDefaultCVMPolicy;
        
# Capture Key Vault and Key details
$encryptionKeyVaultId = (Get-AzKeyVault -VaultName $keyVaultName -ResourceGroupName $ResourceGroupName).ResourceId;
$encryptionKeyURL = (Get-AzKeyVaultKey -VaultName $keyVaultName -KeyName $keyName).Key.Kid;

# Create new DES Config and Disk Encryption Set
$diskEncryptionType = "ConfidentialVmEncryptedWithCustomerKey";
$desConfig = New-AzDiskEncryptionSetConfig -Location $Location -SourceVaultId $encryptionKeyVaultId -KeyUrl $encryptionKeyURL -IdentityType SystemAssigned -EncryptionType $diskEncryptionType;
New-AzDiskEncryptionSet -ResourceGroupName $ResourceGroupName -Name $desName -DiskEncryptionSet $desConfig;
        
$diskencset = Get-AzDiskEncryptionSet -ResourceGroupName $rgname -Name $desName;
        
# Assign DES Access Policy to key vault
$desIdentity = (Get-AzDiskEncryptionSet -Name $desName -ResourceGroupName $ResourceGroupName).Identity.PrincipalId;
        
Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ResourceGroupName $ResourceGroupName -ObjectId $desIdentity -PermissionsToKeys wrapKey,unwrapKey,get -BypassObjectIdValidation;
        
$VirtualMachine = New-AzVMConfig -VMName $VMName -VMSize $vmSize;
$VirtualMachine = Set-AzVMOperatingSystem -VM $VirtualMachine -Windows -ComputerName $computerName -Credential $cred -ProvisionVMAgent -EnableAutoUpdate;
$VirtualMachine = Set-AzVMSourceImage -VM $VirtualMachine -PublisherName 'MicrosoftWindowsServer' -Offer 'windowsserver' -Skus '2022-datacenter-smalldisk-g2' -Version "latest";
        
$subnet = New-AzVirtualNetworkSubnetConfig -Name ($subnetPrefix + $ResourceGroupName) -AddressPrefix "10.0.0.0/24";
$vnet = New-AzVirtualNetwork -Force -Name ($vnetPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $Location -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
$vnet = Get-AzVirtualNetwork -Name ($vnetPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName;
$subnetId = $vnet.Subnets[0].Id;
$pubip = New-AzPublicIpAddress -Force -Name ($pubIpPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $Location -AllocationMethod Static -DomainNameLabel $domainNameLabel2;
$pubip = Get-AzPublicIpAddress -Name ($pubIpPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName;
$pubipId = $pubip.Id;


$nic = New-AzNetworkInterface -Force -Name ($nicPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $Location -SubnetId $subnetId -PublicIpAddressId $pubip.Id;
$nic = Get-AzNetworkInterface -Name ($nicPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName;
$nicId = $nic.Id;

$VirtualMachine = Add-AzVMNetworkInterface -VM $VirtualMachine -Id $nicId;

# Set VM SecurityType and connect to DES
$VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -StorageAccountType "StandardSSD_LRS" -CreateOption "FromImage" -SecurityEncryptionType $secureEncryptGuestState -SecureVMDiskEncryptionSet $diskencset.Id;
$VirtualMachine = Set-AzVMSecurityProfile -VM $VirtualMachine -SecurityType $vmSecurityType;
$VirtualMachine = Set-AzVMUefi -VM $VirtualMachine -EnableVtpm $true -EnableSecureBoot $true;

New-AzVM -ResourceGroupName $ResourceGroupName -Location $Location -Vm $VirtualMachine;
$vm = Get-AzVM -ResourceGroupName $ResourceGroupName -Name $vmname;

# Verify the SecurityEncryptionType value on the disk.
# $vm.StorageProfile.OsDisk.ManagedDisk.SecurityProfile.SecurityEncryptionType == 'DiskWithVMGuestState';

Parâmetros

-Caching

-CreateOption

-DefaultProfile

-DeleteOption

-DiffDiskPlacement

-DiffDiskSetting

-DiskEncryptionKeyUrl

-DiskEncryptionKeyVaultId

-DiskEncryptionSetId

-DiskSizeInGB

-KeyEncryptionKeyUrl

-KeyEncryptionKeyVaultId

-Linux

-ManagedDiskId

-Name

-SecureVMDiskEncryptionSet

-SecurityEncryptionType

-SourceImageUri

-StorageAccountType

-VhdUri

-VM

-Windows

-WriteAccelerator

Entradas

PSVirtualMachine

String

Saídas

PSVirtualMachine

Links Relacionados

• Get-AzVM
• Get-AzAvailabilitySet
• New-AzVMConfig