In this demonstration,
we're going to continue the journey we began on troubleshooting
Azure VMs starting in the previous module.
So continuing to now, let's jump right back into the thick of things.
As you can see,
I was investigating my monitorvm virtual machine running in Azure. This is a
Windows Server 2022 box that's in a work group configuration.
Let's start by looking at disk encryption and just some of the things to
keep in mind with that. Let's go over to Disks, for example, and we can see
our one and only one OS or operating system disk.
We have 0 data disks.
Now let me ask you this, what determines what property of an Azure virtual
machine determines how many data disks that VM can have in Azure,
you know? It's actually the VM size.
The VM size, if we jump over there for a second, in
addition to the virtual hardware,
the CPU and RAM, notice that there is a maximum number of data disks as well.
Okay. So here we are, one and only one OS. This
particular VM doesn't have any data disks.
Now, there's two types of encryption.
So when you're troubleshooting this, first of all,
you need to know what kind of encryption are we talking
about with the VM disks? Now here, if we look at this OS disk,
it says Encryption SSE with PMK. What does that mean?
SSE stands for shared service encryption, or server‑side
encryption. It has a few acronym meanings.
This is the at rest encryption that Microsoft provides in the Azure
datacenter. PMK stands for platform‑managed key.
Now, in troubleshooting, you might realize that due to compliance
requirements, you have to have a customer‑managed key.
How do you do that? Well, let's click into the OS disk,
and here we come down to encryption.
Remember I mentioned that one of the two disk encryption types, you have to
have the VM stopped and deallocated in order to do it.
That's what this is talking about here.
So if we stop and deallocate this virtual machine,
this drop‑down list becomes active, and we can change it to
encryption at rest with a customer‑managed key.
Let's see if I can show you this with my other virtual machine that is
stopped and deallocated. This one, let's go over to Disks,
go to the OS disk,
let's go to Encryption, and this one I'm already using a customer‑managed key.
But what I want you to see is that when you do a
customer‑managed key for your Azure VMs,
you need to create what's called a disk encryption set.
So if I come up here and type disk encryption,
a DES, or a disk encryption set, is an Azure resource that simply maps
to an encryption key that's stored in your key vault.
All right? And so the disk encryption set provides a way for you to apply RBAC permissions on that encryption key.