Implement Azure Key Vault and disk encryption for Azure VMs
In this we will learn how to implement Azure Key Vault and disk encryption for Azure VMs.
However, Azure virtual machines (VMs) can be created through the Azure portal. The Azure portal is a browser-based user interface to create VMs and their associated resources.
Create a virtual machine
- Firstly, choose Create a resource in the upper left corner of the Azure portal.
- Secondly, in the New page, under Popular, select Windows Server 2016 Datacenter.
- Thirdly, in the Basics tab, under Project details, make sure the correct subscription is selected.
- Next, for “Resource Group”, select Create new. Enter myResourceGroup as the name and select Ok. And, for Virtual machine name, enter MyVM.
- Then, for Region, select (US) East US.
- After that, verify that the Size is Standard D2s v3.
- Next, under Administrator account, select Password. Enter a user name and a password.
- Then, select the “Management” tab and verify that you have a Diagnostics Storage Account. However, if you have no storage accounts, select “Create New”, give your new account a name, and select “Ok”
- Next, click “Review + Create”.
- Lastly, on the Create a virtual machine page, you can see the details about the VM you are about to create. When you are ready, select Create.
Encrypt the virtual machine
- Firstly, when the VM deployment is complete, select Go to resource.
- Secondly, on the left-hand sidebar, select Disks.
- Thirdly, on the top bar, select Additional Settings .
- Fourthly, under Encryption settings > Disks to encrypt, select OS and data disks.
- Next, under Encryption settings, choose Select a key vault and key for encryption.
- After that, on the Select key from Azure Key Vault screen, select Create New.
- Then, to the left of Key vault and key, select Click to select a key.
- Next, on the Select key from Azure Key Vault, under the Key Vault field, select Create new.
- After that, on the Create key vault screen, ensure that the Resource Group is myResourceGroup, and give your key vault a name. You must remember that every key vault across Azure must have an unique name.
- Then, on the Access Policies tab, check the Azure Disk Encryption for volume encryption box.
- Now, select Review + create.
- After the key vault has passed validation, select Create. This will return you to the Select key from Azure Key Vault screen.
- Leave the Key field blank and choose Select.
- Lastly, at the top of the encryption screen, click Save. A popup will warn you that the VM will reboot. Click Yes.
Reference: Microsoft Documentation