使用Terraform部署Azure TrustedLaunch类型VM遇SecurityType错误求助

云原生阿岚

2026-7-13

问题解答

那个5个月前的说法已经过时，当前版本的Terraform AzureRM Provider已支持配置security_type参数来启用TrustedLaunch。

错误原因

你碰到的400错误，是因为使用的库镜像强制要求VM必须启用TrustedLaunch，但你的Terraform配置未指定该安全类型，导致Azure拒绝创建请求。

解决方法

在azurerm_linux_virtual_machine或azurerm_windows_virtual_machine资源块中添加以下配置：

明确设置security_type = "TrustedLaunch"
配置security_profile块内的uefi_settings，开启安全启动和vTPM（这是TrustedLaunch的必要组件）

示例配置（以Linux VM为例）：

resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_D2s_v3"
  admin_username      = "adminuser"
  network_interface_ids = [
    azurerm_network_interface.example.id,
  ]

  # 指定TrustedLaunch安全类型
  security_type = "TrustedLaunch"

  security_profile {
    uefi_settings {
      secure_launch_enabled = true
      v_tpm_enabled         = true
    }
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts-gen2"
    version   = "latest"
  }

  admin_ssh_key {
    username   = "adminuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
  }
}

如果是虚拟机规模集（VMSS），配置逻辑一致，在azurerm_linux_virtual_machine_scale_set或azurerm_windows_virtual_machine_scale_set中添加对应的security_type和security_profile块即可。