快速入门:使用 Azure CLI 创建和加密 Windows VMQuickstart: Create and encrypt a Windows VM with the Azure CLI

Azure CLI 用于从命令行或脚本创建和管理 Azure 资源。The Azure CLI is used to create and manage Azure resources from the command line or in scripts. 本快速入门演示如何使用 Azure CLI 创建和加密 Windows Server 2016 虚拟机 (VM)。This quickstart shows you how to use the Azure CLI to create and encrypt a Windows Server 2016 virtual machine (VM).

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

Note

在 Azure China 中使用 Azure CLI 2.0 之前,请首先运行 az cloud set -n AzureChinaCloud 更改云环境。Before you can use Azure CLI 2.0 in Azure China, please run az cloud set -n AzureChinaCloud first to change the cloud environment. 如果要切换回全局 Azure,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Global Azure, run az cloud set -n AzureCloud again.

如果选择在本地安装并使用 CLI,本快速入门要求运行 Azure CLI 2.0.30 或更高版本。If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.30 or later. 运行 az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

创建资源组Create a resource group

使用 az group create 命令创建资源组。Create a resource group with the az group create command. Azure 资源组是在其中部署和管理 Azure 资源的逻辑容器。An Azure resource group is a logical container into which Azure resources are deployed and managed. 以下示例在“chinaeast” 位置创建名为“myResourceGroup” 的资源组:The following example creates a resource group named myResourceGroup in the chinaeast location:

az group create --name myResourceGroup --location chinaeast

创建虚拟机Create a virtual machine

使用 az vm create 创建 VM。Create a VM with az vm create. 以下示例创建一个名为 myVM 的 VM。The following example creates a VM named myVM. 此示例使用 azureuser 作为管理用户名,使用 myPassword12 作为密码。This example uses azureuser for an administrative user name and myPassword12 as the password.

az vm create \
    --resource-group myResourceGroup \
    --name myVM \
    --image win2016datacenter \
    --admin-username azureuser \
    --admin-password myPassword12

创建 VM 和支持资源需要几分钟时间。It takes a few minutes to create the VM and supporting resources. 以下示例输出表明 VM 创建操作已成功。The following example output shows the VM create operation was successful.

{
  "fqdns": "",
  "id": "/subscriptions/<guid>/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM",
  "location": "chinaeast",
  "macAddress": "00-0D-3A-23-9A-49",
  "powerState": "VM running",
  "privateIpAddress": "10.0.0.4",
  "publicIpAddress": "52.174.34.95",
  "resourceGroup": "myResourceGroup"
}

创建为加密密钥配置的密钥保管库Create a Key Vault configured for encryption keys

Azure 磁盘加密将其加密密钥存储在 Azure 密钥保管库中。Azure disk encryption stores its encryption key in an Azure Key Vault. 使用 az keyvault create 创建密钥保管库。Create a Key Vault with az keyvault create. 要使密钥保管库能够存储加密密钥,请使用 --enabled-for-disk-encryption 参数。To enable the Key Vault to store encryption keys, use the --enabled-for-disk-encryption parameter.

Important

每个密钥保管库必须具有唯一的名称。Each Key Vault must have a unique name. 以下示例创建名为“myKV” 的密钥保管库,但你必须将其命名为不同的名称。The following example creates a Key Vault named myKV, but you must name yours something different.

az keyvault create --name "myKV" --resource-group "myResourceGroup" --location chinaeast --enabled-for-disk-encryption

加密虚拟机Encrypt the virtual machine

使用 az vm encryption 加密 VM,为 --disk-encryption-keyvault 参数提供唯一的密钥保管库名称。Encrypt your VM with az vm encryption, providing your unique Key Vault name to the --disk-encryption-keyvault parameter.

az vm encryption enable -g MyResourceGroup --name MyVM --disk-encryption-keyvault myKV

可以使用 az vm show 验证 VM 是否已启用加密You can verify that encryption is enabled on your VM with az vm show

az vm show --name MyVM -g MyResourceGroup

将在返回的输出中看到以下内容:You will see the following in the returned output:

"EncryptionOperation": "EnableEncryption"

清理资源Clean up resources

如果不再需要资源组、VM 和密钥保管库,可以使用 az group delete 命令将其删除。When no longer needed, you can use the az group delete command to remove the resource group, VM, and Key Vault.

az group delete --name myResourceGroup