通过Terraform实现VM使用CMK进行磁盘加密的问题排查

核心问题分析 #

你遇到的OS磁盘仍采用PMK加密的情况，通常是因为磁盘加密集（Disk Encryption Set, DES）的关联逻辑未覆盖OS磁盘创建阶段，或是磁盘加密扩展仅对数据盘生效。以下是两种更可靠的默认实现方式：

方法1：创建VM时直接绑定DES到OS磁盘 #

在定义azurerm_linux_virtual_machine（或azurerm_windows_virtual_machine）资源时，直接在OS磁盘配置块中关联DES，确保OS磁盘从创建之初就使用CMK加密，而非事后补加配置。

示例代码：

# 定义已关联Key Vault CMK的磁盘加密集
resource "azurerm_disk_encryption_set" "example" {
  name                = "example-des"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  key_vault_key_id = azurerm_key_vault_key.example.id

  identity {
    type = "SystemAssigned"
  }
}

# 授权DES访问Key Vault的必要权限
resource "azurerm_key_vault_access_policy" "des" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = azurerm_disk_encryption_set.example.identity.0.tenant_id
  object_id    = azurerm_disk_encryption_set.example.identity.0.principal_id

  key_permissions = [
    "Get", "WrapKey", "UnwrapKey",
  ]
}

# 创建VM时显式指定OS磁盘使用DES加密
resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_D2s_v3"
  admin_username      = "adminuser"
  network_interface_ids = [azurerm_network_interface.example.id]

  admin_ssh_key {
    username   = "adminuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
    # 绑定磁盘加密集，实现CMK加密
    disk_encryption_set_id = azurerm_disk_encryption_set.example.id
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts"
    version   = "latest"
  }
}

关键点：必须在os_disk配置块中显式设置disk_encryption_set_id，跳过这一步会导致OS磁盘默认使用PMK加密。

方法2：单独创建加密后的托管OS磁盘再挂载 #

如果需要自定义OS磁盘参数（如容量、存储类型），可以先创建关联DES的托管磁盘，再将其挂载到VM上。

示例代码：

# 创建已加密的OS托管磁盘
resource "azurerm_managed_disk" "os_disk" {
  name                 = "example-os-disk"
  resource_group_name  = azurerm_resource_group.example.name
  location             = azurerm_resource_group.example.location
  storage_account_type = "Premium_LRS"
  create_option        = "FromImage"
  disk_size_gb         = 30

  source_image_id = "/subscriptions/xxx/Providers/Microsoft.Compute/Locations/xxx/Publishers/Canonical/ArtifactTypes/VMImage/Offers/0001-com-ubuntu-server-jammy/Skus/22_04-lts/Versions/latest"
  
  # 绑定磁盘加密集
  disk_encryption_set_id = azurerm_disk_encryption_set.example.id
}

# 创建VM并挂载加密后的OS磁盘
resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_D2s_v3"
  admin_username      = "adminuser"
  network_interface_ids = [azurerm_network_interface.example.id]

  admin_ssh_key {
    username   = "adminuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    managed_disk_id      = azurerm_managed_disk.os_disk.id
    storage_account_type = "Premium_LRS"
  }
}

这种方式适合需要精细化配置OS磁盘的场景，确保磁盘在创建阶段就应用CMK加密。

常见误区排查 #

• 确保磁盘加密集的系统身份已获得Key Vault的WrapKey、UnwrapKey、Get权限，权限不足会导致加密失败，自动 fallback到PMK。
• 避免依赖事后添加磁盘加密扩展加密OS磁盘，这种方式兼容性有限，创建阶段绑定DES是更稳定的默认实现方案。

内容的提问来源于stack exchange，提问作者Durai Thennarasu