Azure Virtual Machines

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Azure Virtual Machines: a leased machine you boot from an image and keep patching yourself
3# ("Overview of virtual machines in Azure"). Managed disks are encrypted at rest with
4# platform-managed keys by default ("Server-side encryption of Azure managed disks").
5#
6# Spot and confidential VMs are this component, not separate ones: both are priced and created as
7# Virtual Machines.
8#
9# capacity: "spot" is Azure Spot Virtual Machines, unused capacity that Azure reclaims with 30
10# seconds' notice and no SLA ("About Azure Spot Virtual Machines",
11# https://learn.microsoft.com/en-us/azure/virtual-machines/spot-vms). evictionPolicy, maxPriceUsd,
12# evictionNoticeSeconds and slaBacked mean something only when capacity is "spot", so none is
13# defaulted. Azure's own defaults for a Spot VM: eviction policy Deallocate, max price -1 (never
14# evicted for price), 30 seconds' notice, no SLA.
15#
16# securityType: "confidential" is an Azure confidential VM: memory encrypted in use by the hardware,
17# behind a hardware-enforced boundary between the guest and the virtualization stack ("About Azure
18# confidential VMs",
19# https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview). It boots
20# only after successful attestation and carries a dedicated vTPM; confidential OS disk encryption
21# is optional and cannot be changed after deployment, and Secure Boot is on only when that
22# encryption is selected. confidentialComputingTechnology, memoryEncryption, attestation and
23# confidentialOsDiskEncryption mean something only when securityType is "confidential"; virtualTpm
24# and secureBoot also apply to "trusted-launch". None is defaulted.
25schemaVersion: "1"
26type: "component"
27id: "azure-virtual-machine"
28kind: "virtual-machine"
29provider: "azure"
30docs: "https://learn.microsoft.com/en-us/azure/virtual-machines/overview"
31aliases: ["Spot VM", "Azure Spot Virtual Machines", "Confidential VM"]
32defaults:
33  managed: false
34  diskEncryption: true
35  zoneRedundant: false
36properties:
37  capacity:
38    type: "enum"
39    values: ["on-demand", "spot"]
40    default: "on-demand"
41  securityType:
42    type: "enum"
43    values: ["standard", "trusted-launch", "confidential"]
44    default: "trusted-launch"
45  osDiskSizeGib:
46    type: "integer"
47    default: 127
48  managedDisks:
49    type: "boolean"
50    default: true
51  evictionPolicy:
52    type: "enum"
53    values: ["deallocate", "delete"]
54  maxPriceUsd:
55    type: "string"
56  evictionNoticeSeconds:
57    type: "integer"
58  slaBacked:
59    type: "boolean"
60  confidentialComputingTechnology:
61    type: "enum"
62    values: ["amd-sev-snp", "intel-tdx"]
63  memoryEncryption:
64    type: "boolean"
65  attestation:
66    type: "boolean"
67  virtualTpm:
68    type: "boolean"
69  confidentialOsDiskEncryption:
70    type: "boolean"
71  secureBoot:
72    type: "boolean"