Skip to content

Azure VMware Solution: adding KQL Queries for "Use key autorotation for vSAN datastore customer-managed keys" and "Use Azure Boost VMs for Maintenance sensitive workload VMs" #796

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bandapatigoutham wants to merge 2 commits into
base: main
Choose a base branch
from
+54 −2
Open

Azure VMware Solution: adding KQL Queries for "Use key autorotation for vSAN datastore customer-managed keys" and "Use Azure Boost VMs for Maintenance sensitive workload VMs" #796

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf321c0
adding AVS Key Encyrption Method
Dec 11, 2025
c82ba2d
Returns all the virtual machines which are on SKUs supported by Azure…
Dec 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion azure-resources/AVS/privateClouds/kql/e0ac2f57-c8c0-4b8c-a7c8-19e5797828b5.kql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,12 @@
// cannot-be-validated-with-arg
// Azure Resource Graph Query
// This query will return if the encryptionType is Customer-managed key or Microsoft-Managed key. If it is Customer-managed key, the query displays the keyName and keyVaultId
Copy link

Copilot AI Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent capitalization: 'Customer-managed key' should be 'Customer-managed keys' and 'Microsoft-Managed key' should be 'Microsoft-managed keys' to match the actual output values in the query.

Suggested change
// This query will return if the encryptionType is Customer-managed key or Microsoft-Managed key. If it is Customer-managed key, the query displays the keyName and keyVaultId
// This query will return if the encryptionType is Customer-managed keys or Microsoft-managed keys. If it is Customer-managed keys, the query displays the keyName and keyVaultId

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment describes what the query returns but doesn't explain its purpose in the context of key autorotation validation. Consider adding a description of what the query is checking for (e.g., identifying private clouds that need key autorotation configured).

Suggested change
// This query will return if the encryptionType is Customer-managed key or Microsoft-Managed key. If it is Customer-managed key, the query displays the keyName and keyVaultId
// This query identifies AVS private clouds and determines whether they use customer-managed or Microsoft-managed keys, to help validate if key autorotation is required or properly configured. If customer-managed keys are used, the query displays the keyName and keyVaultId for further assessment.

Copilot uses AI. Check for mistakes.
Resources
| where type =~ "microsoft.avs/privateclouds"
| extend keyName = tostring(properties.encryption.keyVaultProperties.keyName)
| extend encryptionType = case(
isnull(keyName) or keyName == "", "Microsoft-managed keys",
"Customer-managed keys"
)
| project subscriptionId, resourceGroup, name, encryptionType,
keyVaultId = tostring(properties.encryption.keyVaultProperties.keyVaultId),
keyName
43 changes: 42 additions & 1 deletion azure-resources/Compute/virtualMachines/kql/9ab499d8-8844-424d-a2d4-8f53690eb8f8.kql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,43 @@
// under-development
// Azure Resource Graph Query
// This query will return all the virtual machines which are on SKUs supported by Azure Boost.

Resources
| where type in~ (
'microsoft.compute/virtualmachines',
'microsoft.compute/virtualmachinescalesets/virtualmachines'
)
| extend vmSize = tolower(tostring(properties.hardwareProfile.vmSize))
// Families from Azure Boost current availability (Sept 2025)
| extend isBoostSku = case(
// Ebsv5 / Ebdsv5
vmSize matches regex @"^standard_e\d+(bs|bds)_v5$", true,
// Lsv3
vmSize matches regex @"^standard_l(8|16|32|48|64|80)s_v3$", true,
// Dsv5 / Ddsv5 / Dds_v5
vmSize matches regex @"^standard_d\d+d?s_v5$", true,
// Dsv6 / Ddsv6 / Dds_v6
vmSize matches regex @"^standard_d\d+d?s_v6$", true,
// Msv3 / Mdsv3
vmSize matches regex @"^standard_m\d+ms_v3$", true,
vmSize matches regex @"^standard_m\d+mds_v3$", true,
// Msv6 / Mdsv6
vmSize matches regex @"^standard_m\d+ms_v6$", true,
vmSize matches regex @"^standard_m\d+mds_v6$", true,
// Fsv2
vmSize matches regex @"^standard_f\d+s_v2$", true,
// Fsv6 / Famsv6 / Falsv6
vmSize matches regex @"^standard_f\d+s_v6$", true,
vmSize matches regex @"^standard_f\d+als_v6$", true,
vmSize matches regex @"^standard_f\d+ams_v6$", true,
// DCesv5 / DCedsv5
vmSize matches regex @"^standard_dce\d+s_v5$", true,
vmSize matches regex @"^standard_dced\d+s_v5$", true,
// GPU: Nvadsv5
vmSize matches regex @"^standard_nvadsv5$", true,
// HPC: HBv4 / HX
vmSize matches regex @"^standard_hbv4$", true,
vmSize matches regex @"^standard_hx$", true,
false
)
| project subscriptionId, resourceGroup, name, location, type, vmSize, isBoostSku
| order by isBoostSku desc, name asc
Loading