From 1a71543dabbf5687318798f02342d89810a40652 Mon Sep 17 00:00:00 2001 From: Feiyue Yu Date: Thu, 18 Mar 2021 17:39:45 +0800 Subject: [PATCH 1/3] [Compute] vm create: Trusted Launch --- .../azure/cli/command_modules/vm/_params.py | 6 ++ .../command_modules/vm/_template_builder.py | 16 +++- .../azure/cli/command_modules/vm/custom.py | 6 +- .../recordings/test_vm_trusted_launch.yaml | 95 +++++++++++++++++++ .../vm/tests/latest/test_vm_commands.py | 11 +++ 5 files changed, 130 insertions(+), 4 deletions(-) create mode 100644 src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml diff --git a/src/azure-cli/azure/cli/command_modules/vm/_params.py b/src/azure-cli/azure/cli/command_modules/vm/_params.py index ae227d21d9d..7947227fadf 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_params.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_params.py @@ -347,6 +347,12 @@ def load_arguments(self, _): c.argument('enable_hotpatching', arg_type=get_three_state_flag(), help='Patch VMs without requiring a reboot. --enable-agent must be set and --patch-mode must be set to AutomaticByPlatform', min_api='2020-12-01') c.argument('platform_fault_domain', min_api='2020-06-01', help='Specify the scale set logical fault domain into which the virtual machine will be created. By default, the virtual machine will be automatically assigned to a fault domain that best maintains balance across available fault domains. This is applicable only if the virtualMachineScaleSet property of this virtual machine is set. The virtual machine scale set that is referenced, must have platform fault domain count. This property cannot be updated once the virtual machine is created. Fault domain assignment can be viewed in the virtual machine instance view') + c.argument('security_type', arg_type=get_enum_type(['TrustedLaunch']), min_api='2020-12-01', + help='Specify if the VM is Trusted Launch enabled') + c.argument('enable_secure_boot', arg_type=get_three_state_flag(), min_api='2020-12-01', + help='Enable secure boot.') + c.argument('enable_vtpm', arg_type=get_three_state_flag(), min_api='2020-12-01', + help='Enable vTPM.') with self.argument_context('vm create', arg_group='Storage') as c: c.argument('attach_os_disk', help='Attach an existing OS disk to the VM. Can use the name or ID of a managed disk or the URI to an unmanaged disk VHD.') diff --git a/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py b/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py index 21e101cbbd3..02356dd2581 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py @@ -256,7 +256,8 @@ def build_vm_resource( # pylint: disable=too-many-locals, too-many-statements computer_name=None, dedicated_host=None, priority=None, max_price=None, eviction_policy=None, enable_agent=None, vmss=None, os_disk_encryption_set=None, data_disk_encryption_sets=None, specialized=None, encryption_at_host=None, dedicated_host_group=None, enable_auto_update=None, patch_mode=None, - enable_hotpatching=None, platform_fault_domain=None): + enable_hotpatching=None, platform_fault_domain=None, security_type=None, enable_secure_boot=None, + enable_vtpm=None): os_caching = disk_info['os'].get('caching') @@ -473,8 +474,19 @@ def _build_storage_profile(): if max_price is not None: vm_properties['billingProfile'] = {'maxPrice': max_price} + vm_properties['securityProfile'] = {'uefiSettings': {}} + if encryption_at_host is not None: - vm_properties['securityProfile'] = {'encryptionAtHost': encryption_at_host} + vm_properties['securityProfile']['encryptionAtHost'] = encryption_at_host + + if security_type is not None: + vm_properties['securityProfile']['securityType'] = security_type + + if enable_secure_boot is not None: + vm_properties['securityProfile']['uefiSettings']['secureBootEnabled'] = enable_secure_boot + + if enable_vtpm is not None: + vm_properties['securityProfile']['uefiSettings']['vTpmEnabled'] = enable_vtpm if platform_fault_domain is not None: vm_properties['platformFaultDomain'] = platform_fault_domain diff --git a/src/azure-cli/azure/cli/command_modules/vm/custom.py b/src/azure-cli/azure/cli/command_modules/vm/custom.py index 181cd1a51d4..0b489310e5a 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/custom.py +++ b/src/azure-cli/azure/cli/command_modules/vm/custom.py @@ -722,7 +722,8 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_ priority=None, max_price=None, eviction_policy=None, enable_agent=None, workspace=None, vmss=None, os_disk_encryption_set=None, data_disk_encryption_sets=None, specialized=None, encryption_at_host=None, enable_auto_update=None, patch_mode=None, ssh_key_name=None, - enable_hotpatching=None, platform_fault_domain=None): + enable_hotpatching=None, platform_fault_domain=None, security_type=None, enable_secure_boot=None, + enable_vtpm=None): from azure.cli.core.commands.client_factory import get_subscription_id from azure.cli.core.util import random_string, hash_string from azure.cli.core.commands.arm import ArmTemplateBuilder @@ -895,7 +896,8 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_ data_disk_encryption_sets=data_disk_encryption_sets, specialized=specialized, encryption_at_host=encryption_at_host, dedicated_host_group=dedicated_host_group, enable_auto_update=enable_auto_update, patch_mode=patch_mode, enable_hotpatching=enable_hotpatching, - platform_fault_domain=platform_fault_domain) + platform_fault_domain=platform_fault_domain, security_type=security_type, enable_secure_boot=enable_secure_boot, + enable_vtpm=enable_vtpm) vm_resource['dependsOn'] = vm_dependencies diff --git a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml new file mode 100644 index 00000000000..b2b821e51a0 --- /dev/null +++ b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml @@ -0,0 +1,95 @@ +interactions: +- request: + body: null + headers: + Accept: + - application/json + Accept-Encoding: + - gzip, deflate + CommandName: + - vm create + Connection: + - keep-alive + ParameterSetName: + - -g -n --image --security-type --enable-secure-boot --enable-vtpm --admin-username + --admin-password --nsg-rule + User-Agent: + - python/3.7.4 (Windows-10-10.0.19041-SP0) msrest/0.6.21 msrest_azure/0.6.3 + azure-mgmt-resource/12.0.0 Azure-SDK-For-Python AZURECLI/2.20.0 + accept-language: + - en-US + method: GET + uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_vm_trusted_launch_000001?api-version=2020-10-01 + response: + body: + string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_vm_trusted_launch_000001","name":"cli_test_vm_trusted_launch_000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","date":"2021-03-18T09:37:13Z"},"properties":{"provisioningState":"Succeeded"}}' + headers: + cache-control: + - no-cache + content-length: + - '428' + content-type: + - application/json; charset=utf-8 + date: + - Thu, 18 Mar 2021 09:37:17 GMT + expires: + - '-1' + pragma: + - no-cache + strict-transport-security: + - max-age=31536000; includeSubDomains + vary: + - Accept-Encoding + x-content-type-options: + - nosniff + status: + code: 200 + message: OK +- request: + body: null + headers: + Accept: + - application/json + Accept-Encoding: + - gzip, deflate + CommandName: + - vm create + Connection: + - keep-alive + ParameterSetName: + - -g -n --image --security-type --enable-secure-boot --enable-vtpm --admin-username + --admin-password --nsg-rule + User-Agent: + - AZURECLI/2.20.0 azsdk-python-azure-mgmt-compute/19.0.0 Python/3.7.4 (Windows-10-10.0.19041-SP0) + method: GET + uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Compute/locations/westus/publishers/MicrosoftWindowsServer/artifacttypes/vmimage/offers/windowsserver-gen2preview-preview/skus/windows10-tvm/versions/18363.592.2001092016?api-version=2020-12-01 + response: + body: + string: "{\r\n \"error\": {\r\n \"code\": \"NotFound\",\r\n \"message\": + \"Artifact: VMImage was not found.\"\r\n }\r\n}" + headers: + cache-control: + - no-cache + content-length: + - '99' + content-type: + - application/json; charset=utf-8 + date: + - Thu, 18 Mar 2021 09:37:18 GMT + expires: + - '-1' + pragma: + - no-cache + server: + - Microsoft-HTTPAPI/2.0 + - Microsoft-HTTPAPI/2.0 + strict-transport-security: + - max-age=31536000; includeSubDomains + x-content-type-options: + - nosniff + x-ms-ratelimit-remaining-resource: + - Microsoft.Compute/GetVMImageFromLocation3Min;12999,Microsoft.Compute/GetVMImageFromLocation30Min;73998 + status: + code: 404 + message: Not Found +version: 1 diff --git a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py index 1133b324010..aa2c0acaab5 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py +++ b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py @@ -5072,5 +5072,16 @@ def test_vm_ssh_key(self, resource_group): self.cmd('sshkey show -g {rg} -n k3') +class VMTrustedLaunchScenarioTest(ScenarioTest): + @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_') + def test_vm_trusted_launch(self, resource_group): + self.cmd('vm create -g {rg} -n vm --image MicrosoftWindowsServer:windowsserver-gen2preview-preview:windows10-tvm:18363.592.2001092016 --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true --admin-username AzureUser --admin-password testPassword0 --nsg-rule None') + self.cmd('vm show -g {rg} -n vm', checks=[ + self.check('securityProfile.securityType', 'TrustedLaunch'), + self.check('securityProfile.UefiSettings.secureBootEnabled', True), + self.check('securityProfile.UefiSettings.vTpmEnabled', True) + ]) + + if __name__ == '__main__': unittest.main() From f4f6567cba91c5ae81007cc2cc8779012b8b1bc0 Mon Sep 17 00:00:00 2001 From: Feiyue Yu Date: Thu, 18 Mar 2021 18:04:10 +0800 Subject: [PATCH 2/3] update --- src/azure-cli/azure/cli/command_modules/vm/_params.py | 4 ++++ src/azure-cli/azure/cli/command_modules/vm/custom.py | 9 ++++++++- .../command_modules/vm/tests/latest/test_vm_commands.py | 7 +++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/src/azure-cli/azure/cli/command_modules/vm/_params.py b/src/azure-cli/azure/cli/command_modules/vm/_params.py index 7947227fadf..b50d60b5afe 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_params.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_params.py @@ -318,6 +318,10 @@ def load_arguments(self, _): help="enable/disable disk write accelerator. Use singular value 'true/false' to apply across, or specify individual disks, e.g.'os=true 1=true 2=true' for os disk and data disks with lun of 1 & 2") c.argument('disk_caching', nargs='*', help="Use singular value to apply across, or specify individual disks, e.g. 'os=ReadWrite 0=None 1=ReadOnly' should enable update os disk and 2 data disks") c.argument('ultra_ssd_enabled', ultra_ssd_enabled_type) + c.argument('enable_secure_boot', arg_type=get_three_state_flag(), min_api='2020-12-01', + help='Enable secure boot.') + c.argument('enable_vtpm', arg_type=get_three_state_flag(), min_api='2020-12-01', + help='Enable vTPM.') with self.argument_context('vm create') as c: c.argument('name', name_arg_type, validator=_resource_not_exists(self.cli_ctx, 'Microsoft.Compute/virtualMachines')) diff --git a/src/azure-cli/azure/cli/command_modules/vm/custom.py b/src/azure-cli/azure/cli/command_modules/vm/custom.py index 0b489310e5a..875b133d6f1 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/custom.py +++ b/src/azure-cli/azure/cli/command_modules/vm/custom.py @@ -1285,7 +1285,8 @@ def show_vm(cmd, resource_group_name, vm_name, show_details=False): def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None, write_accelerator=None, license_type=None, no_wait=False, ultra_ssd_enabled=None, - priority=None, max_price=None, proximity_placement_group=None, workspace=None, **kwargs): + priority=None, max_price=None, proximity_placement_group=None, workspace=None, enable_secure_boot=None, + enable_vtpm=None, **kwargs): from msrestazure.tools import parse_resource_id, resource_id, is_valid_resource_id from ._vm_utils import update_write_accelerator_settings, update_disk_caching vm = kwargs['parameters'] @@ -1329,6 +1330,12 @@ def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None if proximity_placement_group is not None: vm.proximity_placement_group = {'id': proximity_placement_group} + if enable_secure_boot is not None or enable_vtpm is not None: + vm.security_profile = {'uefiSettings': { + 'secureBootEnabled': enable_secure_boot, + 'vTpmEnabled': enable_vtpm + }} + if workspace is not None: workspace_id = _prepare_workspace(cmd, resource_group_name, workspace) workspace_name = parse_resource_id(workspace_id)['name'] diff --git a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py index aa2c0acaab5..6a688d53d33 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py +++ b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py @@ -5073,6 +5073,7 @@ def test_vm_ssh_key(self, resource_group): class VMTrustedLaunchScenarioTest(ScenarioTest): + @unittest.skip('image not found') @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_') def test_vm_trusted_launch(self, resource_group): self.cmd('vm create -g {rg} -n vm --image MicrosoftWindowsServer:windowsserver-gen2preview-preview:windows10-tvm:18363.592.2001092016 --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true --admin-username AzureUser --admin-password testPassword0 --nsg-rule None') @@ -5082,6 +5083,12 @@ def test_vm_trusted_launch(self, resource_group): self.check('securityProfile.UefiSettings.vTpmEnabled', True) ]) + @unittest.skip('image not found') + @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_update_') + def test_vm_trusted_launch_update(self, resource_group): + self.cmd('vm create -g {rg} -n vm --image Win2019Datacenter --security-type TrustedLaunch --admin-username AzureUser --admin-password testPassword0 --nsg-rule None') + self.cmd('vm update -g {rg} -n vm --enable-secure-boot true --enable-vtpm true') + if __name__ == '__main__': unittest.main() From c3e1061a36e207cd1c92147d83af6d984e1d978a Mon Sep 17 00:00:00 2001 From: Feiyue Yu Date: Fri, 19 Mar 2021 11:02:27 +0800 Subject: [PATCH 3/3] update --- .../command_modules/vm/_template_builder.py | 12 +-- .../recordings/test_vm_trusted_launch.yaml | 95 ------------------- .../vm/tests/latest/test_vm_commands.py | 17 ++-- 3 files changed, 17 insertions(+), 107 deletions(-) delete mode 100644 src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml diff --git a/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py b/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py index 02356dd2581..fe99218ca2e 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py +++ b/src/azure-cli/azure/cli/command_modules/vm/_template_builder.py @@ -474,7 +474,7 @@ def _build_storage_profile(): if max_price is not None: vm_properties['billingProfile'] = {'maxPrice': max_price} - vm_properties['securityProfile'] = {'uefiSettings': {}} + vm_properties['securityProfile'] = {} if encryption_at_host is not None: vm_properties['securityProfile']['encryptionAtHost'] = encryption_at_host @@ -482,11 +482,11 @@ def _build_storage_profile(): if security_type is not None: vm_properties['securityProfile']['securityType'] = security_type - if enable_secure_boot is not None: - vm_properties['securityProfile']['uefiSettings']['secureBootEnabled'] = enable_secure_boot - - if enable_vtpm is not None: - vm_properties['securityProfile']['uefiSettings']['vTpmEnabled'] = enable_vtpm + if enable_secure_boot is not None or enable_vtpm is not None: + vm_properties['securityProfile']['uefiSettings'] = { + 'secureBootEnabled': enable_secure_boot, + 'vTpmEnabled': enable_vtpm + } if platform_fault_domain is not None: vm_properties['platformFaultDomain'] = platform_fault_domain diff --git a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml deleted file mode 100644 index b2b821e51a0..00000000000 --- a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml +++ /dev/null @@ -1,95 +0,0 @@ -interactions: -- request: - body: null - headers: - Accept: - - application/json - Accept-Encoding: - - gzip, deflate - CommandName: - - vm create - Connection: - - keep-alive - ParameterSetName: - - -g -n --image --security-type --enable-secure-boot --enable-vtpm --admin-username - --admin-password --nsg-rule - User-Agent: - - python/3.7.4 (Windows-10-10.0.19041-SP0) msrest/0.6.21 msrest_azure/0.6.3 - azure-mgmt-resource/12.0.0 Azure-SDK-For-Python AZURECLI/2.20.0 - accept-language: - - en-US - method: GET - uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_vm_trusted_launch_000001?api-version=2020-10-01 - response: - body: - string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_vm_trusted_launch_000001","name":"cli_test_vm_trusted_launch_000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","date":"2021-03-18T09:37:13Z"},"properties":{"provisioningState":"Succeeded"}}' - headers: - cache-control: - - no-cache - content-length: - - '428' - content-type: - - application/json; charset=utf-8 - date: - - Thu, 18 Mar 2021 09:37:17 GMT - expires: - - '-1' - pragma: - - no-cache - strict-transport-security: - - max-age=31536000; includeSubDomains - vary: - - Accept-Encoding - x-content-type-options: - - nosniff - status: - code: 200 - message: OK -- request: - body: null - headers: - Accept: - - application/json - Accept-Encoding: - - gzip, deflate - CommandName: - - vm create - Connection: - - keep-alive - ParameterSetName: - - -g -n --image --security-type --enable-secure-boot --enable-vtpm --admin-username - --admin-password --nsg-rule - User-Agent: - - AZURECLI/2.20.0 azsdk-python-azure-mgmt-compute/19.0.0 Python/3.7.4 (Windows-10-10.0.19041-SP0) - method: GET - uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Compute/locations/westus/publishers/MicrosoftWindowsServer/artifacttypes/vmimage/offers/windowsserver-gen2preview-preview/skus/windows10-tvm/versions/18363.592.2001092016?api-version=2020-12-01 - response: - body: - string: "{\r\n \"error\": {\r\n \"code\": \"NotFound\",\r\n \"message\": - \"Artifact: VMImage was not found.\"\r\n }\r\n}" - headers: - cache-control: - - no-cache - content-length: - - '99' - content-type: - - application/json; charset=utf-8 - date: - - Thu, 18 Mar 2021 09:37:18 GMT - expires: - - '-1' - pragma: - - no-cache - server: - - Microsoft-HTTPAPI/2.0 - - Microsoft-HTTPAPI/2.0 - strict-transport-security: - - max-age=31536000; includeSubDomains - x-content-type-options: - - nosniff - x-ms-ratelimit-remaining-resource: - - Microsoft.Compute/GetVMImageFromLocation3Min;12999,Microsoft.Compute/GetVMImageFromLocation30Min;73998 - status: - code: 404 - message: Not Found -version: 1 diff --git a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py index 6a688d53d33..4a98afd2658 100644 --- a/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py +++ b/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py @@ -5073,21 +5073,26 @@ def test_vm_ssh_key(self, resource_group): class VMTrustedLaunchScenarioTest(ScenarioTest): - @unittest.skip('image not found') - @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_') + @unittest.skip('Not supported') + @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_', location='southcentralus') def test_vm_trusted_launch(self, resource_group): - self.cmd('vm create -g {rg} -n vm --image MicrosoftWindowsServer:windowsserver-gen2preview-preview:windows10-tvm:18363.592.2001092016 --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true --admin-username AzureUser --admin-password testPassword0 --nsg-rule None') + self.cmd('vm create -g {rg} -n vm --image Win2019Datacenter --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true --admin-username azureuser --admin-password testPassword0 --nsg-rule None') self.cmd('vm show -g {rg} -n vm', checks=[ self.check('securityProfile.securityType', 'TrustedLaunch'), self.check('securityProfile.UefiSettings.secureBootEnabled', True), self.check('securityProfile.UefiSettings.vTpmEnabled', True) ]) - @unittest.skip('image not found') - @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_update_') + @unittest.skip('Not supported') + @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_update_', location='southcentralus') def test_vm_trusted_launch_update(self, resource_group): - self.cmd('vm create -g {rg} -n vm --image Win2019Datacenter --security-type TrustedLaunch --admin-username AzureUser --admin-password testPassword0 --nsg-rule None') + self.cmd('vm create -g {rg} -n vm --image Win2019Datacenter --security-type TrustedLaunch --admin-username azureuser --admin-password testPassword0 --nsg-rule None') self.cmd('vm update -g {rg} -n vm --enable-secure-boot true --enable-vtpm true') + self.cmd('vm show -g {rg} -n vm', checks=[ + self.check('securityProfile.securityType', 'TrustedLaunch'), + self.check('securityProfile.UefiSettings.secureBootEnabled', True), + self.check('securityProfile.UefiSettings.vTpmEnabled', True) + ]) if __name__ == '__main__':