Skip to content

Commit

Permalink
Merge pull request #13713 from amccullough84/secure-boot
Browse files Browse the repository at this point in the history 
r/azurerm_windows_virtual_machine and r/azurerm_windows_virtual_machine_scale_set - secure_boot_enabled, security_type, vtpm_enabled
  • Loading branch information
@tombuildsstuff
tombuildsstuff authored Nov 17, 2021
2 parents 3d300f1 + aa1b7dd commit dbde9ec
Show file tree
Hide file tree
Showing 6 changed files with 357 additions and 13 deletions.
77 changes: 70 additions & 7 deletions internal/services/compute/windows_virtual_machine_resource.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -242,6 +242,12 @@ func resourceWindowsVirtualMachine() *pluginsdk.Resource {

"secret": windowsSecretSchema(),

"secure_boot_enabled": {
Type: pluginsdk.TypeBool,
Optional: true,
ForceNew: true,
},

"source_image_id": {
Type: pluginsdk.TypeString,
Optional: true,
Expand Down Expand Up @@ -282,6 +288,12 @@ func resourceWindowsVirtualMachine() *pluginsdk.Resource {
ValidateFunc: validation.IntAtLeast(-1),
},

"vtpm_enabled": {
Type: pluginsdk.TypeBool,
Optional: true,
ForceNew: true,
},

"winrm_listener": winRmListenerSchema(),

"zone": {
Expand Down Expand Up @@ -480,9 +492,43 @@ func resourceWindowsVirtualMachineCreate(d *pluginsdk.ResourceData, meta interfa
}

if encryptionAtHostEnabled, ok := d.GetOk("encryption_at_host_enabled"); ok {
params.VirtualMachineProperties.SecurityProfile = &compute.SecurityProfile{
EncryptionAtHost: utils.Bool(encryptionAtHostEnabled.(bool)),
if params.SecurityProfile == nil {
params.SecurityProfile = &compute.SecurityProfile{}
}
params.SecurityProfile.EncryptionAtHost = utils.Bool(encryptionAtHostEnabled.(bool))
}

if securebootEnabled, ok := d.GetOk("secure_boot_enabled"); ok {
if params.SecurityProfile == nil {
params.SecurityProfile = &compute.SecurityProfile{}
}

if params.SecurityProfile.UefiSettings == nil {
params.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}

secureboot := d.Get("secure_boot_enabled").(bool)
if secureboot {
params.SecurityProfile.SecurityType = compute.SecurityTypesTrustedLaunch
}

params.SecurityProfile.UefiSettings.SecureBootEnabled = utils.Bool(securebootEnabled.(bool))
}

if vtpmEnabled, ok := d.GetOk("vtpm_enabled"); ok {
if params.SecurityProfile == nil {
params.SecurityProfile = &compute.SecurityProfile{}
}

if params.SecurityProfile.UefiSettings == nil {
params.SecurityProfile.UefiSettings = &compute.UefiSettings{}
}
vtpm := d.Get("vtpm_enabled").(bool)
if vtpm {
params.SecurityProfile.SecurityType = compute.SecurityTypesTrustedLaunch
}

params.SecurityProfile.UefiSettings.VTpmEnabled = utils.Bool(vtpmEnabled.(bool))
}

if evictionPolicyRaw, ok := d.GetOk("eviction_policy"); ok {
Expand Down Expand Up @@ -725,10 +771,26 @@ func resourceWindowsVirtualMachineRead(d *pluginsdk.ResourceData, meta interface
}

encryptionAtHostEnabled := false
if props.SecurityProfile != nil && props.SecurityProfile.EncryptionAtHost != nil {
encryptionAtHostEnabled = *props.SecurityProfile.EncryptionAtHost
vtpmEnabled := false
secureBootEnabled := false

if secprofile := props.SecurityProfile; secprofile != nil {
if secprofile.EncryptionAtHost != nil {
encryptionAtHostEnabled = *secprofile.EncryptionAtHost
}
if uefi := props.SecurityProfile.UefiSettings; uefi != nil {
if uefi.VTpmEnabled != nil {
vtpmEnabled = *uefi.VTpmEnabled
}
if uefi.SecureBootEnabled != nil {
secureBootEnabled = *uefi.SecureBootEnabled
}
}
}

d.Set("encryption_at_host_enabled", encryptionAtHostEnabled)
d.Set("vtpm_enabled", vtpmEnabled)
d.Set("secure_boot_enabled", secureBootEnabled)

d.Set("virtual_machine_id", props.VMID)

Expand Down Expand Up @@ -1009,10 +1071,11 @@ func resourceWindowsVirtualMachineUpdate(d *pluginsdk.ResourceData, meta interfa
if d.HasChange("encryption_at_host_enabled") {
shouldUpdate = true
shouldDeallocate = true // API returns the following error if not deallocate: 'securityProfile.encryptionAtHost' can be updated only when VM is in deallocated state

update.VirtualMachineProperties.SecurityProfile = &compute.SecurityProfile{
EncryptionAtHost: utils.Bool(d.Get("encryption_at_host_enabled").(bool)),
if update.SecurityProfile == nil {
update.SecurityProfile = &compute.SecurityProfile{}
}
update.SecurityProfile.EncryptionAtHost = utils.Bool(d.Get("encryption_at_host_enabled").(bool))

}

if d.HasChange("license_type") {
Expand Down
98 changes: 98 additions & 0 deletions internal/services/compute/windows_virtual_machine_resource_other_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -865,6 +865,40 @@ func TestAccWindowsVirtualMachine_otherEncryptionAtHostEnabledUpdate(t *testing.
})
}

func TestAccWindowsVirtualMachine_otherSecureBootEnabled(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherSecureBootEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
})
}

func TestAccWindowsVirtualMachine_otherVTpmEnabled(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherVTpmEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep(
"admin_password",
),
})
}

func TestAccWindowsVirtualMachine_otherEncryptionAtHostEnabledWithCMK(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine", "test")
r := WindowsVirtualMachineResource{}
Expand Down Expand Up @@ -2394,6 +2428,70 @@ resource "azurerm_windows_virtual_machine" "test" {
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineResource) otherSecureBootEnabled(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s
resource "azurerm_windows_virtual_machine" "test" {
name = local.vm_name
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
size = "Standard_DS3_v2"
admin_username = "adminuser"
admin_password = "P@$$w0rd1234!"
network_interface_ids = [
azurerm_network_interface.test.id,
]
os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter-gensecond"
version = "latest"
}
secure_boot_enabled = %t
}
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineResource) otherVTpmEnabled(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s
resource "azurerm_windows_virtual_machine" "test" {
name = local.vm_name
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
size = "Standard_DS3_v2"
admin_username = "adminuser"
admin_password = "P@$$w0rd1234!"
network_interface_ids = [
azurerm_network_interface.test.id,
]
os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter-gensecond"
version = "latest"
}
vtpm_enabled = %t
}
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineResource) otherEncryptionAtHostEnabledWithCMK(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s
Expand Down
112 changes: 112 additions & 0 deletions internal/services/compute/windows_virtual_machine_scale_set_other_resource_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -677,6 +677,36 @@ func TestAccWindowsVirtualMachineScaleSet_otherEncryptionAtHostEnabledWithCMK(t
})
}

func TestAccWindowsVirtualMachineScaleSet_otherSecureBootEnabled(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine_scale_set", "test")
r := WindowsVirtualMachineScaleSetResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherSecureBootEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("admin_password"),
})
}

func TestAccWindowsVirtualMachineScaleSet_otherVTpmEnabled(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine_scale_set", "test")
r := WindowsVirtualMachineScaleSetResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.otherVTpmEnabled(data, true),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("admin_password"),
})
}

func TestAccWindowsVirtualMachineScaleSet_otherPlatformFaultDomainCount(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_windows_virtual_machine_scale_set", "test")
r := WindowsVirtualMachineScaleSetResource{}
Expand Down Expand Up @@ -2545,6 +2575,88 @@ resource "azurerm_windows_virtual_machine_scale_set" "test" {
`, r.disksOSDisk_diskEncryptionSetResource(data), enabled)
}

func (r WindowsVirtualMachineScaleSetResource) otherSecureBootEnabled(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s
resource "azurerm_windows_virtual_machine_scale_set" "test" {
name = local.vm_name
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
sku = "Standard_DS3_V2"
instances = 1
admin_username = "adminuser"
admin_password = "P@ssword1234!"
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2019-Datacenter-gensecond"
version = "latest"
}
os_disk {
storage_account_type = "Standard_LRS"
caching = "ReadWrite"
}
network_interface {
name = "example"
primary = true
ip_configuration {
name = "internal"
primary = true
subnet_id = azurerm_subnet.test.id
}
}
secure_boot_enabled = %t
}
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineScaleSetResource) otherVTpmEnabled(data acceptance.TestData, enabled bool) string {
return fmt.Sprintf(`
%s
resource "azurerm_windows_virtual_machine_scale_set" "test" {
name = local.vm_name
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
sku = "Standard_DS3_V2"
instances = 1
admin_username = "adminuser"
admin_password = "P@ssword1234!"
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2019-Datacenter-gensecond"
version = "latest"
}
os_disk {
storage_account_type = "Standard_LRS"
caching = "ReadWrite"
}
network_interface {
name = "example"
primary = true
ip_configuration {
name = "internal"
primary = true
subnet_id = azurerm_subnet.test.id
}
}
vtpm_enabled = %t
}
`, r.template(data), enabled)
}

func (r WindowsVirtualMachineScaleSetResource) otherPlatformFaultDomainCount(data acceptance.TestData) string {
return fmt.Sprintf(`
%s
Expand Down
Loading

0 comments on commit dbde9ec

Please sign in to comment.