Skip to content

Commit 840f3b6

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #305175 from linuxelf001/patch-43
Clarify VMMD documentation for confidential VMs
2 parents bd40f27 + 5a45a17 commit 840f3b6

2 files changed

Lines changed: 250 additions & 0 deletions

File tree

‎articles/confidential-computing/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,8 @@
6767
href: how-to-create-custom-image-confidential-vm.md
6868
- name: How to migrate nested confidential VMs from one region to another
6969
href: migrate-nested-confidential-vms.md
70+
- name: Virtual Machine Metablob Disk
71+
href: virtual-machine-metablob-disk.md
7072
- name: Quickly create confidential VMs
7173
items:
7274
- name: Create VM through the Azure portal

‎articles/confidential-computing/virtual-machine-metablob-disk.md‎

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
---
2+
title: Virtual Machine Metablob Disk
3+
description: Information on Virtual Machine Metablob Disk (VMMD)
4+
author: linuxelf001
5+
ms.topic: concept-article
6+
ms.service: azure-virtual-machines
7+
ms.subservice: sizes
8+
ms.date: 09/05/2025
9+
ms.author: raginjup
10+
ms.reviewer: raginjup
11+
---
12+
# Virtual Machine Metablob Disk
13+
14+
This article outlines the changes to be aware when using confidential virtual machines with Virtual Machine Metablob (VMMD) disk.
15+
16+
> [!NOTE]
17+
> The VMMD feature support described here are available in Azure REST API version **2025-01-02** and later, Azure CLI version **2.77.0** and later, Azure PowerShell version **14.4.0** and later.
18+
19+
## Prerequisites
20+
21+
Before you begin, ensure you have the following:
22+
23+
* An Azure account with an active subscription. [Create an account for free.](https://azure.microsoft.com/free)
24+
* A confidential virtual machine with managed disks.
25+
* The appropriate version of the tools you are using:
26+
* Azure REST API version 2025-01-02 or later.
27+
* Azure CLI version 2.77.0 or later.
28+
* Azure PowerShell version 14.4.0 or later.
29+
30+
## Disk Access
31+
The process for granting access to confidential virtual machine disks has been updated to provide a SAS URI for the Virtual Machine Metadata Disk (VMMD) blob. This is in addition to the existing SAS URIs for the OS disk and the VM guest state (VMGS) blob.
32+
33+
### [Azure REST API](#tab/rest-access)
34+
35+
To get the VMMD SAS URI using the Azure REST API, use the `beginGetAccess` endpoint with version `2025-01-02` or later.
36+
37+
Grant access to a confidential virtual machine disk
38+
* API: beginGetAccess
39+
* New in response: securityMetadataAccessSAS
40+
41+
**Sample HTTP Request:**
42+
43+
```http
44+
POST https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/disks/myDisk/beginGetAccess?api-version=2025-01-02
45+
46+
{
47+
"access": "Read",
48+
"durationInSeconds": 300,
49+
"fileFormat": "VHD"
50+
}
51+
```
52+
53+
**Sample Response:**
54+
55+
Status code: 200
56+
57+
```json
58+
{
59+
"accessSAS": "OS disk SAS URI",
60+
"securityDataAccessSAS": "VM Guest State SAS URI",
61+
"securityMetadataAccessSAS": "VM Metadata SAS URI"
62+
}
63+
```
64+
Detailed documentation and more examples using Java, Go, JavaScript, or dotnet [are available here.](/rest/api/compute/disks/create-or-update?view=rest-compute-2025-01-02&tabs=HTTP#create-a-managed-disk-from-importsecure-create-option-with-metadata-uri-for-confidential-vm&preserve-view=true)
65+
66+
### [Azure CLI](#tab/cli-access)
67+
68+
When using the `az disk grant-access` command in Azure CLI version 2.77.0 or later, confidential virtual machines with three blobs include the `securityMetadataAccessSAS`.
69+
70+
**Example:**
71+
72+
```shell
73+
diskSas=$(az disk grant-access \
74+
-n $diskName \
75+
-g $resourceGroupName \
76+
--access-level Write \
77+
--duration-in-seconds 86400 \
78+
--secure-vm-guest-state-sas)
79+
```
80+
81+
**Returned value schema:**
82+
83+
```json
84+
{
85+
"accessSAS": "OS disk SAS URI",
86+
"securityDataAccessSAS": "VM Guest State SAS URI",
87+
"securityMetadataAccessSAS": "VM Metadata SAS URI"
88+
}
89+
```
90+
91+
### [Azure PowerShell](#tab/powershell-access)
92+
93+
With Azure PowerShell version 14.4.0 or later, the `Grant-AzDiskAccess` cmdlet now returns an object that includes the `securityMetadataAccessSAS`.
94+
95+
**Example:**
96+
97+
```powershell
98+
Grant-AzDiskAccess `
99+
-ResourceGroupName 'ResourceGroup01' `
100+
-DiskName 'Disk01' `
101+
-Access 'Read' `
102+
-DurationInSecond 60 `
103+
-SecureVmGuestStateSas
104+
```
105+
> [!NOTE]
106+
> Multiline commands in PowerShell require a trailing backtick (\`) character, which must have a space preceding it. There should NOT be any space or trailing comments after the backtick (\`) either. You may avoid this issue by entering the whole command in a single line.
107+
108+
**Returned value schema:**
109+
110+
```json
111+
{
112+
"accessSAS": "OS disk SAS URI",
113+
"securityDataAccessSAS": "VM Guest State SAS URI",
114+
"securityMetadataAccessSAS": "VM Metadata SAS URI"
115+
}
116+
```
117+
118+
---
119+
120+
## Create
121+
122+
### [Azure REST API](#tab/rest-create)
123+
124+
To create a confidential virtual machine disk with VMMD URI
125+
* API: createOption ImportSecure
126+
* Include: securityMetadataUri in the request
127+
128+
**Sample HTTP Request:**
129+
130+
```http
131+
PUT https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/disks/myDisk?api-version=2025-01-02
132+
133+
{
134+
"location": "West US",
135+
"properties": {
136+
"osType": "Windows",
137+
"securityProfile": {
138+
"securityType": "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey"
139+
},
140+
"creationData": {
141+
"createOption": "ImportSecure",
142+
"storageAccountId": "subscriptions/{subscriptionId}/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/myStorageAccount",
143+
"sourceUri": "https://mystorageaccount.blob.core.windows.net/osimages/osimage.vhd",
144+
"securityDataUri": "https://mystorageaccount.blob.core.windows.net/osimages/vmgs.vhd",
145+
"securityMetadataUri": "https://mystorageaccount.blob.core.windows.net/osimages/vmmd.vhd"
146+
}
147+
}
148+
}
149+
150+
```
151+
152+
**Sample Response:**
153+
154+
Status code: 200
155+
156+
```json
157+
{
158+
"id": "/subscriptions/{subscriptionId}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/disks/myDisk",
159+
"name": "myDisk",
160+
"location": "West US",
161+
"properties": {
162+
"provisioningState": "Updating",
163+
"osType": "Windows",
164+
"securityProfile": {
165+
"securityType": "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey"
166+
},
167+
"creationData": {
168+
"createOption": "ImportSecure",
169+
"storageAccountId": "subscriptions/{subscriptionId}/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/myStorageAccount",
170+
"sourceUri": "https://mystorageaccount.blob.core.windows.net/osimages/osimage.vhd",
171+
"securityDataUri": "https://mystorageaccount.blob.core.windows.net/osimages/vmgs.vhd",
172+
"securityMetadataUri": "https://mystorageaccount.blob.core.windows.net/osimages/vmmd.vhd"
173+
}
174+
}
175+
}
176+
```
177+
Detailed documentation and more examples using Java, Go, JavaScript, or dotnet [are available here.](/rest/api/compute/disks/create-or-update?view=rest-compute-2025-01-02&tabs=HTTP#create-a-managed-disk-from-importsecure-create-option-with-metadata-uri-for-confidential-vm&preserve-view=true)
178+
179+
### [Azure CLI](#tab/cli-create)
180+
181+
To create a confidential virtual machine disk with VMMD URI
182+
* Include the --security-metadata-uri parameter.
183+
* Requires Azure CLI version 2.77.0 or later.
184+
185+
**Example:**
186+
187+
```shell
188+
az disk create -n $diskName -g $resourceGroup -l $location --os-type Windows --hyper-v-generation V2 --security-type "ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey" --source $sourceDiskVhdUri --security-data-uri $guestStateDiskVhdUri --security-metadata-uri $metadataDiskVhdUri \ --sku standard_lrs
189+
```
190+
191+
**Returned value schema:**
192+
193+
```json
194+
{
195+
"accessSAS": "OS disk SAS URI",
196+
"securityDataAccessSAS": "VM Guest State SAS URI",
197+
"securityMetadataAccessSAS": "VM Metadata SAS URI"
198+
}
199+
```
200+
201+
### [Azure PowerShell](#tab/powershell-create)
202+
203+
With Azure PowerShell version 14.4.0 or later, the `Grant-AzDiskAccess` cmdlet now returns an object that includes the `securityMetadataAccessSAS`.
204+
205+
**Example:**
206+
207+
```powershell
208+
Grant-AzDiskAccess `
209+
-ResourceGroupName 'ResourceGroup01' `
210+
-DiskName 'Disk01' `
211+
-Access 'Read' `
212+
-DurationInSecond 60 `
213+
-SecureVmGuestStateSas
214+
```
215+
> [!NOTE]
216+
> Multiline commands in PowerShell require a trailing backtick (\`) character, which must have a space preceding it. There should NOT be any space or trailing comments after the backtick (\`) either. You may avoid this issue by entering the whole command in a single line.
217+
218+
**Returned value schema:**
219+
220+
```json
221+
{
222+
"accessSAS": "OS disk SAS URI",
223+
"securityDataAccessSAS": "VM Guest State SAS URI",
224+
"securityMetadataAccessSAS": "VM Metadata SAS URI"
225+
}
226+
```
227+
---
228+
229+
When using UploadPreparedSecure, upload the VMMD blob in addition to the OS and VMGS blobs if the source includes VMMD.
230+
231+
232+
## FAQ
233+
234+
**Q: What is the VMMD blob?**
235+
236+
**A:** The VMMD (Virtual Machine Metadata) blob contains metadata for a confidential VM.
237+
238+
For more, see our [confidential VM FAQ](/azure/confidential-computing/confidential-vm-faq) and our [managed disk FAQ](/azure/virtual-machines/faq-for-disks)
239+
240+
## Next Steps
241+
242+
* [Deploy a confidential VM from Azure](/azure/confidential-computing/quick-create-confidential-vm-portal)
243+
* [Azure confidential computing documentation](/azure/confidential-computing/)
244+
245+
## Related Articles
246+
247+
* [Azure managed disks overview](/azure/virtual-machines/managed-disks-overview)
248+
* [Managed disk migration guide](/azure/virtual-machines/linux/convert-unmanaged-to-managed-disks)

0 commit comments

Comments
 (0)