diff --git a/quickstart/201-confidential-vm/main.tf b/quickstart/201-confidential-vm/main.tf index 71ffe5da..ce7679c2 100644 --- a/quickstart/201-confidential-vm/main.tf +++ b/quickstart/201-confidential-vm/main.tf @@ -1,13 +1,19 @@ +resource "random_pet" "prefix" {} + resource "azurerm_resource_group" "example" { - name = "${var.name_prefix}-rg" + name = "${random_pet.prefix.id}-rg" location = var.location } // Key Vault and Disk Encryption Set data "azurerm_client_config" "current" {} +locals { + current_user_object_id = coalesce(var.msi_id, data.azurerm_client_config.current.object_id) +} + resource "azurerm_key_vault" "example" { - name = "${var.name_prefix}-kv" + name = "${random_pet.prefix.id}-kv" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name sku_name = "premium" @@ -20,7 +26,7 @@ resource "azurerm_key_vault" "example" { resource "azurerm_key_vault_access_policy" "service-principal" { key_vault_id = azurerm_key_vault.example.id tenant_id = data.azurerm_client_config.current.tenant_id - object_id = data.azurerm_client_config.current.object_id + object_id = local.current_user_object_id key_permissions = [ "Create", @@ -56,7 +62,7 @@ resource "azurerm_key_vault_key" "example" { } resource "azurerm_disk_encryption_set" "example" { - name = "${var.name_prefix}-des" + name = "${random_pet.prefix.id}-des" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location key_vault_key_id = azurerm_key_vault_key.example.id @@ -82,21 +88,21 @@ resource "azurerm_key_vault_access_policy" "disk-encryption" { // Virtual Machine resource "azurerm_virtual_network" "example" { - name = "${var.name_prefix}-vnet" + name = "${random_pet.prefix.id}-vnet" address_space = ["10.0.0.0/16"] location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name } resource "azurerm_subnet" "example" { - name = "${var.name_prefix}-subnet" + name = "${random_pet.prefix.id}-subnet" resource_group_name = azurerm_resource_group.example.name virtual_network_name = azurerm_virtual_network.example.name address_prefixes = ["10.0.2.0/24"] } resource "azurerm_network_interface" "example" { - name = "${var.name_prefix}-nic" + name = "${random_pet.prefix.id}-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name @@ -107,22 +113,27 @@ resource "azurerm_network_interface" "example" { } } +resource "tls_private_key" "vm_key" { + algorithm = "RSA" + rsa_bits = 4096 +} + resource "azurerm_linux_virtual_machine" "test" { - name = "${var.name_prefix}-vm" + name = "${random_pet.prefix.id}-vm" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location - + # Available sizes for Confidential VM can be found at: https://docs.microsoft.com/azure/confidential-computing/confidential-vm-overview - size = "Standard_DC2as_v5" - - admin_username = "azureuser" + size = "Standard_DC2as_v5" + + admin_username = "azureuser" network_interface_ids = [ azurerm_network_interface.example.id, ] admin_ssh_key { username = "azureuser" - public_key = var.vm_public_key + public_key = tls_private_key.vm_key.public_key_openssh } os_disk { diff --git a/quickstart/201-confidential-vm/outputs.tf b/quickstart/201-confidential-vm/outputs.tf new file mode 100644 index 00000000..60a9a6a5 --- /dev/null +++ b/quickstart/201-confidential-vm/outputs.tf @@ -0,0 +1,4 @@ +output "vm_private_key" { + sensitive = true + value = tls_private_key.vm_key.private_key_pem +} \ No newline at end of file diff --git a/quickstart/201-confidential-vm/providers.tf b/quickstart/201-confidential-vm/providers.tf index 4accb4e0..47c061fb 100644 --- a/quickstart/201-confidential-vm/providers.tf +++ b/quickstart/201-confidential-vm/providers.tf @@ -4,7 +4,15 @@ terraform { required_providers { azurerm = { source = "hashicorp/azurerm" - version = "~>3.8" + version = ">= 3.0, < 4.0" + } + random = { + source = "hashicorp/random" + version = ">= 3.0" + } + tls = { + source = "hashicorp/tls" + version = "4.0.4" } } } diff --git a/quickstart/201-confidential-vm/variables.tf b/quickstart/201-confidential-vm/variables.tf index b5e9aa6e..dda86dd8 100644 --- a/quickstart/201-confidential-vm/variables.tf +++ b/quickstart/201-confidential-vm/variables.tf @@ -1,14 +1,11 @@ variable "location" { type = string + default = "eastus" description = "Location where resources will be created" } -variable "name_prefix" { - type = string - description = "Prefix of the resource name" -} - -variable "vm_public_key" { - type = string - description = "Public key of the Virtual Machine" -} +variable "msi_id" { + type = string + default = null + description = "If you're executing the test with user assigned identity, please pass the identity principal id to this variable." +} \ No newline at end of file