5

I am running the following script:

$keyVault = Get-AzKeyVault -VaultName $keyVaultName -ResourceGroupName $rgName;
$diskEncryptionKeyVaultUrl = $keyVault.VaultUri;
$keyVaultResourceId = $keyVault.ResourceId;
$keyEncryptionKeyUrl = (Get-AzureKeyVaultKey -VaultName $keyVaultName -Name myKey).Key.kid;

Set-AzVMDiskEncryptionExtension -ResourceGroupName $rgName `
-VMName "myVM" `
-DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl `
-DiskEncryptionKeyVaultId $keyVaultResourceId `
-KeyEncryptionKeyUrl $keyEncryptionKeyUrl `
-KeyEncryptionKeyVaultId $keyVaultResourceId

which is returning the following around 1 minutes of processing:

Set-AzureRmVmDiskEncryptionExtension : Long running operation failed with status 'Failed'. Additional Info:'VM has reported a failure when processing extension 'AzureDiskEncryption'. Error message: "Failed to send DiskEncryptionData, Check KeyVault inputs, ResourceIds and retry encryption operation".' ErrorCode: VMExtensionProvisioningError ErrorMessage: VM has reported a failure when processing extension 'AzureDiskEncryption'. Error message: "Failed to send DiskEncryptionData, Check KeyVault inputs, ResourceIds and retry encryption operation". ErrorTarget: StartTime: 3/2/19 2:10:59 PM EndTime: 3/2/19 2:10:59 PM

i have verified the values are all correctly passed to the set command and no nulls are being passed.

4c74356b41
  • 69,186
  • 6
  • 100
  • 141
Baahubali
  • 4,604
  • 6
  • 33
  • 72
  • is the kv enabled for disk encryption? do you have permissions to the kv? – 4c74356b41 Mar 02 '19 at 14:50
  • under the actual key, it has encrypt/decrypt, sign, verify, wrap and unwrap key checkboxes signed but i can't find a property saying enable for disk encryption? is that somewhere else? i created the azure key vault, key, virtual machine and harddisk and running the powershell command under the same account. is there a way i can ensure i have the permissions to access the key vault? i can access it fine through the GUI – Baahubali Mar 02 '19 at 14:57
  • under permissions, there are advanced permissions, you can enable KV for disk encryption there – 4c74356b41 Mar 02 '19 at 15:03
  • i could find access policy under the key vault and noticed that under the key permissions cryptographic operations were not allowed. however even after ticking all of them (encrypt, decrypt, sign, verify, wrap key, unwrap key), the error message thrown is the same. is there certain amount of time does the changes take effect in or its very instant? – Baahubali Mar 02 '19 at 15:11
  • you need advanced access policies as well, it wont work without them. https://user-images.githubusercontent.com/2538465/42705932-65a1aeb0-86ab-11e8-9d6e-ddff3fae5cb5.png – 4c74356b41 Mar 02 '19 at 15:19
  • thank you. that worked. could you add it as answer and i will accept it. – Baahubali Mar 03 '19 at 02:04

3 Answers3

10

in this case OP needed to enable Key Vault for disk encryption, under advanced access policies.

enter image description here

4c74356b41
  • 69,186
  • 6
  • 100
  • 141
4

I had this issue but banging my head for days the below steps fixed my issue.

  1. Check the values of the $KeyVault, $DiskEncryptionKeyVaultUrl, and $KeyVaultResourceId variables and make sure they are not null or empty.
  2. If step 1 is completed, check the Key Vault creation process thoroughly, and check if it is in the same region as the VM and that it has been enabled for disk encryption:Set-AzureRmKeyVaultAccessPolicy -VaultName $keyVaultName - EnabledForDiskEncryption
Priya
  • 367
  • 3
  • 5
  • 2
    Enabling this policy didn't solve the issue for me at first. I ran the script in the Azure cloud shell and I found out the session seems to cache the keyvault settings. After I closed the session and opened a new one, it worked right away. – Jean-Paul Smit May 17 '19 at 15:43
4

If you are still facing the issue, you can try this:

  1. Go to the disk of a VM that needs to be encrypted.
  2. Click Identity
  3. Turn Status to "ON" for a system or user assigned.

enter image description here

Then execute below commands. It is available with explanation on https://learn.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disks

$keyVault = Get-AzKeyVault -VaultName $keyVaultName -ResourceGroupName $rgName;

$diskEncryptionKeyVaultUrl = $keyVault.VaultUri;

$keyVaultResourceId = $keyVault.ResourceId;

$keyEncryptionKeyUrl = (Get-AzKeyVaultKey -VaultName $keyVaultName -Name myKey).Key.kid;

Set-AzVMDiskEncryptionExtension -ResourceGroupName $rgName `

-VMName "myVM" 
-DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl `
-DiskEncryptionKeyVaultId $keyVaultResourceId `
-KeyEncryptionKeyUrl $keyEncryptionKeyUrl `
-KeyEncryptionKeyVaultId $keyVaultResourceId$
Bhargav Rao
  • 50,140
  • 28
  • 121
  • 140
Vishal Koul
  • 41
  • 2