Microsoft.Compute diskEncryptionSets 2020-06-30

Bicep resource definition

The diskEncryptionSets resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Usage Examples

Bicep Samples

A basic example of deploying Disk Encryption Set.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource vault 'Microsoft.KeyVault/vaults@2023-02-01' = {
  name: resourceName
  location: location
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    accessPolicies: []
    enableSoftDelete: true
    tenantId: tenant().tenantId
  }
}

resource key 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
  name: resourceName
  parent: vault
  properties: {
    keyOps: [
      'encrypt'
      'decrypt'
      'sign'
      'verify'
      'wrapKey'
      'unwrapKey'
    ]
    keySize: 2048
    kty: 'RSA'
  }
}

resource diskEncryptionSet 'Microsoft.Compute/diskEncryptionSets@2022-03-02' = {
  name: resourceName
  location: location
  properties: {
    activeKey: {
      sourceVault: {
        id: vault.id
      }
    }
    encryptionType: 'EncryptionAtRestWithCustomerKey'
    rotationToLatestKeyVersionEnabled: false
  }
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Resource format

To create a Microsoft.Compute/diskEncryptionSets resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Compute/diskEncryptionSets@2020-06-30' = {
  identity: {
    type: 'string'
  }
  location: 'string'
  name: 'string'
  properties: {
    activeKey: {
      keyUrl: 'string'
      sourceVault: {
        id: 'string'
      }
    }
    encryptionType: 'string'
  }
  tags: {
    {customized property}: 'string'
  }
}

Property Values

Microsoft.Compute/diskEncryptionSets

EncryptionSetIdentity

EncryptionSetProperties

KeyVaultAndKeyReference

ResourceTags

SourceVault

ARM template resource definition

The diskEncryptionSets resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.

Usage Examples

Resource format

To create a Microsoft.Compute/diskEncryptionSets resource, add the following JSON to your template.

{
  "type": "Microsoft.Compute/diskEncryptionSets",
  "apiVersion": "2020-06-30",
  "name": "string",
  "identity": {
    "type": "string"
  },
  "location": "string",
  "properties": {
    "activeKey": {
      "keyUrl": "string",
      "sourceVault": {
        "id": "string"
      }
    },
    "encryptionType": "string"
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property Values

Microsoft.Compute/diskEncryptionSets

EncryptionSetIdentity

EncryptionSetProperties

KeyVaultAndKeyReference

ResourceTags

SourceVault

Terraform (AzAPI provider) resource definition

The diskEncryptionSets resource type can be deployed with operations that target:

• Resource groups For a list of changed properties in each API version, see change log.

Usage Examples

Terraform Samples

A basic example of deploying Disk Encryption Set.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
    azurerm = {
      source = "hashicorp/azurerm"
    }
  }
}

provider "azurerm" {
  features {
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

data "azurerm_client_config" "current" {
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "vault" {
  type      = "Microsoft.KeyVault/vaults@2023-02-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      sku = {
        family = "A"
        name   = "standard"
      }
      accessPolicies   = []
      enableSoftDelete = true
      tenantId         = data.azurerm_client_config.current.tenant_id
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
  lifecycle {
    ignore_changes = [body.properties.accessPolicies]
  }
}

data "azapi_resource_id" "key" {
  type      = "Microsoft.KeyVault/vaults/keys@2023-02-01"
  parent_id = azapi_resource.vault.id
  name      = var.resource_name
}

resource "azapi_resource_action" "key" {
  type        = "Microsoft.KeyVault/vaults/keys@2023-02-01"
  resource_id = data.azapi_resource_id.key.id
  method      = "PUT"
  body = {
    properties = {
      keySize = 2048
      kty     = "RSA"
      keyOps  = ["encrypt", "decrypt", "sign", "verify", "wrapKey", "unwrapKey"]
    }
  }
  response_export_values = ["*"]
}

resource "azapi_resource" "diskEncryptionSet" {
  type      = "Microsoft.Compute/diskEncryptionSets@2022-03-02"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  identity {
    type         = "SystemAssigned"
    identity_ids = []
  }
  body = {
    properties = {
      activeKey = {
        keyUrl = azapi_resource_action.key.output.properties.keyUriWithVersion
        sourceVault = {
          id = azapi_resource.vault.id
        }
      }
      encryptionType                    = "EncryptionAtRestWithCustomerKey"
      rotationToLatestKeyVersionEnabled = false
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Resource format

To create a Microsoft.Compute/diskEncryptionSets resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Compute/diskEncryptionSets@2020-06-30"
  name = "string"
  parent_id = "string"
  identity {
    type = "string"
    identity_ids = [
      "string"
    ]
  }
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = {
    properties = {
      activeKey = {
        keyUrl = "string"
        sourceVault = {
          id = "string"
        }
      }
      encryptionType = "string"
    }
  }
}

Property Values

Microsoft.Compute/diskEncryptionSets

EncryptionSetIdentity

EncryptionSetProperties

KeyVaultAndKeyReference

ResourceTags

SourceVault