pulumi-azure-kotlin/com.pulumi.azure.compute.kotlin/DiskEncryptionSet

DiskEncryptionSet

class DiskEncryptionSet : KotlinCustomResource

Manages a Disk Encryption Set.

NOTE: At this time the Key Vault used to store the Active Key for this Disk Encryption Set must have both Soft Delete & Purge Protection enabled - which are not yet supported by this provider.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.AccessPolicy;
import com.pulumi.azure.keyvault.AccessPolicyArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.compute.DiskEncryptionSet;
import com.pulumi.azure.compute.DiskEncryptionSetArgs;
import com.pulumi.azure.compute.inputs.DiskEncryptionSetIdentityArgs;
import com.pulumi.azure.authorization.Assignment;
import com.pulumi.azure.authorization.AssignmentArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .enabledForDiskEncryption(true)
            .purgeProtectionEnabled(true)
            .build());
        var example_user = new AccessPolicy("example-user", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
            .keyPermissions(
                "Create",
                "Delete",
                "Get",
                "Purge",
                "Recover",
                "Update",
                "List",
                "Decrypt",
                "Sign",
                "GetRotationPolicy")
            .build());
        var exampleKey = new Key("exampleKey", KeyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .build(), CustomResourceOptions.builder()
                .dependsOn(example_user)
                .build());
        var exampleDiskEncryptionSet = new DiskEncryptionSet("exampleDiskEncryptionSet", DiskEncryptionSetArgs.builder()
            .resourceGroupName(exampleResourceGroup.name())
            .location(exampleResourceGroup.location())
            .keyVaultKeyId(exampleKey.id())
            .identity(DiskEncryptionSetIdentityArgs.builder()
                .type("SystemAssigned")
                .build())
            .build());
        var example_diskAccessPolicy = new AccessPolicy("example-diskAccessPolicy", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(exampleDiskEncryptionSet.identity().applyValue(identity -> identity.tenantId()))
            .objectId(exampleDiskEncryptionSet.identity().applyValue(identity -> identity.principalId()))
            .keyPermissions(
                "Create",
                "Delete",
                "Get",
                "Purge",
                "Recover",
                "Update",
                "List",
                "Decrypt",
                "Sign")
            .build());
        var example_diskAssignment = new Assignment("example-diskAssignment", AssignmentArgs.builder()
            .scope(exampleKeyVault.id())
            .roleDefinitionName("Key Vault Crypto Service Encryption User")
            .principalId(exampleDiskEncryptionSet.identity().applyValue(identity -> identity.principalId()))
            .build());
    }
}
Content copied to clipboard

With Automatic Key Rotation Enabled

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.AccessPolicy;
import com.pulumi.azure.keyvault.AccessPolicyArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.compute.DiskEncryptionSet;
import com.pulumi.azure.compute.DiskEncryptionSetArgs;
import com.pulumi.azure.compute.inputs.DiskEncryptionSetIdentityArgs;
import com.pulumi.azure.authorization.Assignment;
import com.pulumi.azure.authorization.AssignmentArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var current = CoreFunctions.getClientConfig();
        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()
            .location("West Europe")
            .build());
        var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .skuName("premium")
            .enabledForDiskEncryption(true)
            .purgeProtectionEnabled(true)
            .build());
        var example_user = new AccessPolicy("example-user", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
            .objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
            .keyPermissions(
                "Create",
                "Delete",
                "Get",
                "Purge",
                "Recover",
                "Update",
                "List",
                "Decrypt",
                "Sign",
                "GetRotationPolicy")
            .build());
        var exampleKey = new Key("exampleKey", KeyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .keyType("RSA")
            .keySize(2048)
            .keyOpts(
                "decrypt",
                "encrypt",
                "sign",
                "unwrapKey",
                "verify",
                "wrapKey")
            .build(), CustomResourceOptions.builder()
                .dependsOn(example_user)
                .build());
        var exampleDiskEncryptionSet = new DiskEncryptionSet("exampleDiskEncryptionSet", DiskEncryptionSetArgs.builder()
            .resourceGroupName(exampleResourceGroup.name())
            .location(exampleResourceGroup.location())
            .keyVaultKeyId(exampleKey.versionlessId())
            .autoKeyRotationEnabled(true)
            .identity(DiskEncryptionSetIdentityArgs.builder()
                .type("SystemAssigned")
                .build())
            .build());
        var example_diskAccessPolicy = new AccessPolicy("example-diskAccessPolicy", AccessPolicyArgs.builder()
            .keyVaultId(exampleKeyVault.id())
            .tenantId(exampleDiskEncryptionSet.identity().applyValue(identity -> identity.tenantId()))
            .objectId(exampleDiskEncryptionSet.identity().applyValue(identity -> identity.principalId()))
            .keyPermissions(
                "Create",
                "Delete",
                "Get",
                "Purge",
                "Recover",
                "Update",
                "List",
                "Decrypt",
                "Sign")
            .build());
        var example_diskAssignment = new Assignment("example-diskAssignment", AssignmentArgs.builder()
            .scope(exampleKeyVault.id())
            .roleDefinitionName("Key Vault Crypto Service Encryption User")
            .principalId(exampleDiskEncryptionSet.identity().applyValue(identity -> identity.principalId()))
            .build());
    }
}
Content copied to clipboard

Import

Disk Encryption Sets can be imported using the resource id, e.g.

$ pulumi import azure:compute/diskEncryptionSet:DiskEncryptionSet example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.Compute/diskEncryptionSets/encryptionSet1
Content copied to clipboard

Properties

Link copied to clipboard
Link copied to clipboard
val encryptionType: Output<String>?

The type of key used to encrypt the data of the disk. Possible values are EncryptionAtRestWithCustomerKey, EncryptionAtRestWithPlatformAndCustomerKeys and ConfidentialVmEncryptedWithCustomerKey. Defaults to EncryptionAtRestWithCustomerKey. Changing this forces a new resource to be created.

Link copied to clipboard
val federatedClientId: Output<String>?

Multi-tenant application client id to access key vault in a different tenant.

Link copied to clipboard
val id: Output<String>
Link copied to clipboard
val identity: Output<DiskEncryptionSetIdentity>

An identity block as defined below.

Link copied to clipboard
val keyVaultKeyId: Output<String>

Specifies the URL to a Key Vault Key (either from a Key Vault Key, or the Key URL for the Key Vault Secret).

Link copied to clipboard
val keyVaultKeyUrl: Output<String>

The URL for the Key Vault Key or Key Vault Secret that is currently being used by the service.

Link copied to clipboard
val location: Output<String>

Specifies the Azure Region where the Disk Encryption Set exists. Changing this forces a new resource to be created.

Link copied to clipboard
val name: Output<String>

The name of the Disk Encryption Set. Changing this forces a new resource to be created.

Link copied to clipboard
val pulumiChildResources: Set<KotlinResource>
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
val resourceGroupName: Output<String>

Specifies the name of the Resource Group where the Disk Encryption Set should exist. Changing this forces a new resource to be created.

Link copied to clipboard
val tags: Output<Map<String, String>>?

A mapping of tags to assign to the Disk Encryption Set.

Link copied to clipboard
val urn: Output<String>