201-confidential-vm patch (#146)

* fix 201-confidential-vm example

---------

Co-authored-by: zjhe <hezijie@microsoft.com>

quickstart/201-confidential-vm/main.tf

@@ -1,13 +1,19 @@
+resource "random_pet" "prefix" {}
+
 resource "azurerm_resource_group" "example" {
-  name     = "${var.name_prefix}-rg"
+  name     = "${random_pet.prefix.id}-rg"
   location = var.location
 }
 
 // Key Vault and Disk Encryption Set
 data "azurerm_client_config" "current" {}
 
+locals {
+  current_user_object_id = coalesce(var.msi_id, data.azurerm_client_config.current.object_id)
+}
+
 resource "azurerm_key_vault" "example" {
-  name                        = "${var.name_prefix}-kv"
+  name                        = "${random_pet.prefix.id}-kv"
   location                    = azurerm_resource_group.example.location
   resource_group_name         = azurerm_resource_group.example.name
   sku_name                    = "premium"
@@ -20,7 +26,7 @@ resource "azurerm_key_vault" "example" {
 resource "azurerm_key_vault_access_policy" "service-principal" {
   key_vault_id = azurerm_key_vault.example.id
   tenant_id    = data.azurerm_client_config.current.tenant_id
-  object_id    = data.azurerm_client_config.current.object_id
+  object_id    = local.current_user_object_id
 
   key_permissions = [
     "Create",
@@ -56,7 +62,7 @@ resource "azurerm_key_vault_key" "example" {
 }
 
 resource "azurerm_disk_encryption_set" "example" {
-  name                = "${var.name_prefix}-des"
+  name                = "${random_pet.prefix.id}-des"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_resource_group.example.location
   key_vault_key_id    = azurerm_key_vault_key.example.id
@@ -82,21 +88,21 @@ resource "azurerm_key_vault_access_policy" "disk-encryption" {
 
 // Virtual Machine
 resource "azurerm_virtual_network" "example" {
-  name                = "${var.name_prefix}-vnet"
+  name                = "${random_pet.prefix.id}-vnet"
   address_space       = ["10.0.0.0/16"]
   location            = azurerm_resource_group.example.location
   resource_group_name = azurerm_resource_group.example.name
 }
 
 resource "azurerm_subnet" "example" {
-  name                 = "${var.name_prefix}-subnet"
+  name                 = "${random_pet.prefix.id}-subnet"
   resource_group_name  = azurerm_resource_group.example.name
   virtual_network_name = azurerm_virtual_network.example.name
   address_prefixes     = ["10.0.2.0/24"]
 }
 
 resource "azurerm_network_interface" "example" {
-  name                = "${var.name_prefix}-nic"
+  name                = "${random_pet.prefix.id}-nic"
   location            = azurerm_resource_group.example.location
   resource_group_name = azurerm_resource_group.example.name
 
@@ -107,22 +113,27 @@ resource "azurerm_network_interface" "example" {
   }
 }
 
+resource "tls_private_key" "vm_key" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
 resource "azurerm_linux_virtual_machine" "test" {
-  name                = "${var.name_prefix}-vm"
+  name                = "${random_pet.prefix.id}-vm"
   resource_group_name = azurerm_resource_group.example.name
   location            = azurerm_resource_group.example.location
-  
+
   # Available sizes for Confidential VM can be found at: https://docs.microsoft.com/azure/confidential-computing/confidential-vm-overview
-  size                = "Standard_DC2as_v5"
-  
-  admin_username      = "azureuser"
+  size = "Standard_DC2as_v5"
+
+  admin_username        = "azureuser"
   network_interface_ids = [
     azurerm_network_interface.example.id,
   ]
 
   admin_ssh_key {
     username   = "azureuser"
-    public_key = var.vm_public_key
+    public_key = tls_private_key.vm_key.public_key_openssh
   }
 
   os_disk {

quickstart/201-confidential-vm/outputs.tf

@@ -0,0 +1,4 @@
+output "vm_private_key" {
+  sensitive = true
+  value     = tls_private_key.vm_key.private_key_pem
+}

quickstart/201-confidential-vm/providers.tf

@@ -4,7 +4,15 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~>3.8"
+      version = ">= 3.0, < 4.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.0"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "4.0.4"
     }
   }
 }

quickstart/201-confidential-vm/variables.tf

@@ -1,14 +1,11 @@
 variable "location" {
   type        = string
+  default     = "eastus"
   description = "Location where resources will be created"
 }
 
-variable "name_prefix" {
-  type        = string
-  description = "Prefix of the resource name"
-}
-
-variable "vm_public_key" {
-  type        = string
-  description = "Public key of the Virtual Machine"
-}
+variable "msi_id" {
+  type = string
+  default = null
+  description = "If you're executing the test with user assigned identity, please pass the identity principal id to this variable."
+}