[Compute] vm create: Trusted Launch

src/azure-cli/azure/cli/command_modules/vm/_params.py

@@ -318,6 +318,10 @@ def load_arguments(self, _):
                    help="enable/disable disk write accelerator. Use singular value 'true/false' to apply across, or specify individual disks, e.g.'os=true 1=true 2=true' for os disk and data disks with lun of 1 & 2")
         c.argument('disk_caching', nargs='*', help="Use singular value to apply across, or specify individual disks, e.g. 'os=ReadWrite 0=None 1=ReadOnly' should enable update os disk and 2 data disks")
         c.argument('ultra_ssd_enabled', ultra_ssd_enabled_type)
+        c.argument('enable_secure_boot', arg_type=get_three_state_flag(), min_api='2020-12-01',
+                   help='Enable secure boot.')
+        c.argument('enable_vtpm', arg_type=get_three_state_flag(), min_api='2020-12-01',
+                   help='Enable vTPM.')
 
     with self.argument_context('vm create') as c:
         c.argument('name', name_arg_type, validator=_resource_not_exists(self.cli_ctx, 'Microsoft.Compute/virtualMachines'))
@@ -347,6 +351,12 @@ def load_arguments(self, _):
         c.argument('enable_hotpatching', arg_type=get_three_state_flag(), help='Patch VMs without requiring a reboot. --enable-agent must be set and --patch-mode must be set to AutomaticByPlatform', min_api='2020-12-01')
         c.argument('platform_fault_domain', min_api='2020-06-01',
                    help='Specify the scale set logical fault domain into which the virtual machine will be created. By default, the virtual machine will be automatically assigned to a fault domain that best maintains balance across available fault domains. This is applicable only if the virtualMachineScaleSet property of this virtual machine is set. The virtual machine scale set that is referenced, must have platform fault domain count. This property cannot be updated once the virtual machine is created. Fault domain assignment can be viewed in the virtual machine instance view')
+        c.argument('security_type', arg_type=get_enum_type(['TrustedLaunch']), min_api='2020-12-01',
+                   help='Specify if the VM is Trusted Launch enabled')
+        c.argument('enable_secure_boot', arg_type=get_three_state_flag(), min_api='2020-12-01',
+                   help='Enable secure boot.')
+        c.argument('enable_vtpm', arg_type=get_three_state_flag(), min_api='2020-12-01',
+                   help='Enable vTPM.')
 
     with self.argument_context('vm create', arg_group='Storage') as c:
         c.argument('attach_os_disk', help='Attach an existing OS disk to the VM. Can use the name or ID of a managed disk or the URI to an unmanaged disk VHD.')

src/azure-cli/azure/cli/command_modules/vm/_template_builder.py

@@ -256,7 +256,8 @@ def build_vm_resource(  # pylint: disable=too-many-locals, too-many-statements
         computer_name=None, dedicated_host=None, priority=None, max_price=None, eviction_policy=None,
         enable_agent=None, vmss=None, os_disk_encryption_set=None, data_disk_encryption_sets=None, specialized=None,
         encryption_at_host=None, dedicated_host_group=None, enable_auto_update=None, patch_mode=None,
-        enable_hotpatching=None, platform_fault_domain=None):
+        enable_hotpatching=None, platform_fault_domain=None, security_type=None, enable_secure_boot=None,
+        enable_vtpm=None):
 
     os_caching = disk_info['os'].get('caching')
 
@@ -473,8 +474,19 @@ def _build_storage_profile():
     if max_price is not None:
         vm_properties['billingProfile'] = {'maxPrice': max_price}
 
+    vm_properties['securityProfile'] = {'uefiSettings': {}}
+
     if encryption_at_host is not None:
-        vm_properties['securityProfile'] = {'encryptionAtHost': encryption_at_host}
+        vm_properties['securityProfile']['encryptionAtHost'] = encryption_at_host
+
+    if security_type is not None:
+        vm_properties['securityProfile']['securityType'] = security_type
+
+    if enable_secure_boot is not None:
+        vm_properties['securityProfile']['uefiSettings']['secureBootEnabled'] = enable_secure_boot
+
+    if enable_vtpm is not None:
+        vm_properties['securityProfile']['uefiSettings']['vTpmEnabled'] = enable_vtpm
 
     if platform_fault_domain is not None:
         vm_properties['platformFaultDomain'] = platform_fault_domain

src/azure-cli/azure/cli/command_modules/vm/custom.py

@@ -722,7 +722,8 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_
               priority=None, max_price=None, eviction_policy=None, enable_agent=None, workspace=None, vmss=None,
               os_disk_encryption_set=None, data_disk_encryption_sets=None, specialized=None,
               encryption_at_host=None, enable_auto_update=None, patch_mode=None, ssh_key_name=None,
-              enable_hotpatching=None, platform_fault_domain=None):
+              enable_hotpatching=None, platform_fault_domain=None, security_type=None, enable_secure_boot=None,
+              enable_vtpm=None):
     from azure.cli.core.commands.client_factory import get_subscription_id
     from azure.cli.core.util import random_string, hash_string
     from azure.cli.core.commands.arm import ArmTemplateBuilder
@@ -895,7 +896,8 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_DS1_
         data_disk_encryption_sets=data_disk_encryption_sets, specialized=specialized,
         encryption_at_host=encryption_at_host, dedicated_host_group=dedicated_host_group,
         enable_auto_update=enable_auto_update, patch_mode=patch_mode, enable_hotpatching=enable_hotpatching,
-        platform_fault_domain=platform_fault_domain)
+        platform_fault_domain=platform_fault_domain, security_type=security_type, enable_secure_boot=enable_secure_boot,
+        enable_vtpm=enable_vtpm)
 
     vm_resource['dependsOn'] = vm_dependencies
 
@@ -1283,7 +1285,8 @@ def show_vm(cmd, resource_group_name, vm_name, show_details=False):
 
 def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None,
               write_accelerator=None, license_type=None, no_wait=False, ultra_ssd_enabled=None,
-              priority=None, max_price=None, proximity_placement_group=None, workspace=None, **kwargs):
+              priority=None, max_price=None, proximity_placement_group=None, workspace=None, enable_secure_boot=None,
+              enable_vtpm=None, **kwargs):
     from msrestazure.tools import parse_resource_id, resource_id, is_valid_resource_id
     from ._vm_utils import update_write_accelerator_settings, update_disk_caching
     vm = kwargs['parameters']
@@ -1327,6 +1330,12 @@ def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None
     if proximity_placement_group is not None:
         vm.proximity_placement_group = {'id': proximity_placement_group}
 
+    if enable_secure_boot is not None or enable_vtpm is not None:
+        vm.security_profile = {'uefiSettings': {
+            'secureBootEnabled': enable_secure_boot,
+            'vTpmEnabled': enable_vtpm
+        }}
+
     if workspace is not None:
         workspace_id = _prepare_workspace(cmd, resource_group_name, workspace)
         workspace_name = parse_resource_id(workspace_id)['name']

src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_trusted_launch.yaml

@@ -0,0 +1,95 @@
+interactions:
+- request:
+    body: null
+    headers:
+      Accept:
+      - application/json
+      Accept-Encoding:
+      - gzip, deflate
+      CommandName:
+      - vm create
+      Connection:
+      - keep-alive
+      ParameterSetName:
+      - -g -n --image --security-type --enable-secure-boot --enable-vtpm --admin-username
+        --admin-password --nsg-rule
+      User-Agent:
+      - python/3.7.4 (Windows-10-10.0.19041-SP0) msrest/0.6.21 msrest_azure/0.6.3
+        azure-mgmt-resource/12.0.0 Azure-SDK-For-Python AZURECLI/2.20.0
+      accept-language:
+      - en-US
+    method: GET
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/cli_test_vm_trusted_launch_000001?api-version=2020-10-01
+  response:
+    body:
+      string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_vm_trusted_launch_000001","name":"cli_test_vm_trusted_launch_000001","type":"Microsoft.Resources/resourceGroups","location":"westus","tags":{"product":"azurecli","cause":"automation","date":"2021-03-18T09:37:13Z"},"properties":{"provisioningState":"Succeeded"}}'
+    headers:
+      cache-control:
+      - no-cache
+      content-length:
+      - '428'
+      content-type:
+      - application/json; charset=utf-8
+      date:
+      - Thu, 18 Mar 2021 09:37:17 GMT
+      expires:
+      - '-1'
+      pragma:
+      - no-cache
+      strict-transport-security:
+      - max-age=31536000; includeSubDomains
+      vary:
+      - Accept-Encoding
+      x-content-type-options:
+      - nosniff
+    status:
+      code: 200
+      message: OK
+- request:
+    body: null
+    headers:
+      Accept:
+      - application/json
+      Accept-Encoding:
+      - gzip, deflate
+      CommandName:
+      - vm create
+      Connection:
+      - keep-alive
+      ParameterSetName:
+      - -g -n --image --security-type --enable-secure-boot --enable-vtpm --admin-username
+        --admin-password --nsg-rule
+      User-Agent:
+      - AZURECLI/2.20.0 azsdk-python-azure-mgmt-compute/19.0.0 Python/3.7.4 (Windows-10-10.0.19041-SP0)
+    method: GET
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Compute/locations/westus/publishers/MicrosoftWindowsServer/artifacttypes/vmimage/offers/windowsserver-gen2preview-preview/skus/windows10-tvm/versions/18363.592.2001092016?api-version=2020-12-01
+  response:
+    body:
+      string: "{\r\n  \"error\": {\r\n    \"code\": \"NotFound\",\r\n    \"message\":
+        \"Artifact: VMImage was not found.\"\r\n  }\r\n}"
+    headers:
+      cache-control:
+      - no-cache
+      content-length:
+      - '99'
+      content-type:
+      - application/json; charset=utf-8
+      date:
+      - Thu, 18 Mar 2021 09:37:18 GMT
+      expires:
+      - '-1'
+      pragma:
+      - no-cache
+      server:
+      - Microsoft-HTTPAPI/2.0
+      - Microsoft-HTTPAPI/2.0
+      strict-transport-security:
+      - max-age=31536000; includeSubDomains
+      x-content-type-options:
+      - nosniff
+      x-ms-ratelimit-remaining-resource:
+      - Microsoft.Compute/GetVMImageFromLocation3Min;12999,Microsoft.Compute/GetVMImageFromLocation30Min;73998
+    status:
+      code: 404
+      message: Not Found
+version: 1

src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py

@@ -5072,5 +5072,23 @@ def test_vm_ssh_key(self, resource_group):
         self.cmd('sshkey show -g {rg} -n k3')
 
 
+class VMTrustedLaunchScenarioTest(ScenarioTest):
+    @unittest.skip('image not found')
+    @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_')
+    def test_vm_trusted_launch(self, resource_group):
+        self.cmd('vm create -g {rg} -n vm --image MicrosoftWindowsServer:windowsserver-gen2preview-preview:windows10-tvm:18363.592.2001092016 --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true --admin-username AzureUser --admin-password testPassword0 --nsg-rule None')
+        self.cmd('vm show -g {rg} -n vm', checks=[
+            self.check('securityProfile.securityType', 'TrustedLaunch'),
+            self.check('securityProfile.UefiSettings.secureBootEnabled', True),
+            self.check('securityProfile.UefiSettings.vTpmEnabled', True)
+        ])
+
+    @unittest.skip('image not found')
+    @ResourceGroupPreparer(name_prefix='cli_test_vm_trusted_launch_update_')
+    def test_vm_trusted_launch_update(self, resource_group):
+        self.cmd('vm create -g {rg} -n vm --image Win2019Datacenter --security-type TrustedLaunch --admin-username AzureUser --admin-password testPassword0 --nsg-rule None')
+        self.cmd('vm update -g {rg} -n vm --enable-secure-boot true --enable-vtpm true')
+
+
 if __name__ == '__main__':
     unittest.main()