Edit

Share via

Guest attestation for Trusted launch for Azure Local VMs (preview)

Applies to: Azure Local 2509 and later

This article describes how to enable guest attestation for Trusted launch for Azure Local virtual machines (VMs) enabled by Azure Arc. Guest attestation, also called boot integrity verification, is a new feature you can preview starting with Azure Local version 2509.

Guest attestation allows you to verify if the VM started in a well-known good state – specifically, verify integrity of the entire boot chain. This helps detect any unexpected changes to the boot chain (firmware, OS boot loader, and drivers) so you can take corrective actions if the boot chain is compromised.

When you enable guest attestation, an Azure Arc extension called guest attestation extension is deployed on the VM. The guest attestation extension interacts with Azure services such as Microsoft Azure Attestation service to support boot integrity verification.

Prerequisites

Enable guest attestation

You can enable guest attestation when you create a Trusted launch Azure Local VM via Azure portal.

  1. See Create Azure Local virtual machines enabled by Azure Arc for general instructions to create a Trusted launch Azure Local VM via Azure portal.

    Note

    Specify a network interface when creating the VM. Trusted launch requires a network connection for attestation purposes.

  2. When creating the VM, choose security type as Trusted launch.

  3. Select Configure security features and choose Integrity monitoring (preview).

    Screenshot of security features section.

  4. Once the virtual machine is created, you can view guest attestation status via the VM resource page:

    Screenshot of the create virtual machine page.

    Guest attestation status Meaning
    Healthy Secure boot is enabled, virtual TPM is enabled, and boot integrity verification was successful.
    Unhealthy Secure boot isn't enabled, or virtual TPM isn't enabled, or boot integrity monitoring was not successful.
    Unknown Status isn't available, likely due to transient network or communication issues.

    The timestamp shows when guest attestation status was last verified. The status normally refreshes about every eight hours. If the VM is in a running state but the guest attestation status hasn't updated in over eight hours, this may be because the guest attestation extension stopped working or possibly the VM is compromised.

  5. You can view the status of the guest attestation extension on the Extensions page:

    Screenshot showing the VM extensions page.

    If the status of the guest attestation extension is reported as Failed, you can view the detailed error status:

    Screenshot showing the error details page.

Guidance

  • Guest attestation support relies on and uses the Microsoft Azure Attestation service. When guest attestation is supported, the Azure Local instance is automatically set up with a Microsoft Azure Attestation service endpoint and an attestation policy. For guest attestation to work properly, outbound network access to the Microsoft Azure Attestation service is required. Make sure that relevant policies or network firewall rules for your Azure Local instance allow outbound network access to the Microsoft Azure Attestation service.

    For example, when using Azure Policy to manage the security posture of your Azure Local instance, you shouldn't disallow resource type Microsoft.Attestation/attestationProviders. For more information, see Disallow resource types in your cloud environment. Specifically, the policy Microsoft.Attestation/attestationProviders/publicNetworkAccess must be enabled.

  • There may be situations when you need to manually set up a Microsoft Azure Attestation service endpoint and an associated attestation policy for your Azure Local instance. For example, you may accidentally delete the attestation provider (and the associated attestation policy) from the resource group of your Azure Local instance. Another example, you want to update the attestation policy to use a different attestation root certificate that was provisioned into your Azure Local instance.

    In such situations, you can run the following to manually set up a Microsoft Azure Attestation service endpoint and an attestation policy for your Azure Local instance. The commands below must be run from one of the machines (nodes) in your Azure Local instance.

$ececlient = create-ececlusterserviceclient

# Create MAA Endpoint
$guid= Invoke-ActionPlanInstance -RolePath Cloud\Infrastructure\ArcIntegration -ActionType "CreateMAAEndpointCloud" -EceClient $ececlient

# Validate MAA Endpoint creation succeeded
Get-ActionPlanInstance -ActionPlanInstanceId $guid -ececlient:$ececlient

# Create MAA Policy
$guid= Invoke-ActionPlanInstance -RolePath Cloud\Infrastructure\ArcIntegration -ActionType "CreateMAAPolicyCloud" -EceClient $ececlient

# Validate MAA Policy creation succeeded
Get-ActionPlanInstance -ActionPlanInstanceId $guid -ececlient:$ececlient

# Sample expected output
# InstanceID: <guid>
# ActionPlanName:
# ActionTypeName: CreateMAAEndpointCloud
# RolePath: Cloud\Infrastructure\ArcIntegration
# ProgressAsXml: <xml-object>
# Status: Completed
# ...

Next steps

  • Last updated on