diskEncryptionSet.json

{
  "swagger": "2.0",
  "info": {
    "title": "DiskResourceProviderClient",
    "description": "The Disk Resource Provider Client.",
    "version": "2022-07-02"
  },
  "host": "management.azure.com",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "security": [
    {
      "azure_auth": [
        "user_impersonation"
      ]
    }
  ],
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "flow": "implicit",
      "description": "Azure Active Directory OAuth2 Flow",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  },
  "paths": {
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{diskEncryptionSetName}": {
      "put": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_CreateOrUpdate",
        "description": "Creates or updates a disk encryption set",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "./diskRPCommon.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "#/parameters/DiskEncryptionSetNameParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          },
          {
            "name": "diskEncryptionSet",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSet"
            },
            "description": "disk encryption set object supplied in the body of the Put disk encryption set operation."
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSet"
            }
          },
          "202": {
            "description": "Accepted",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSet"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "Create a disk encryption set.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Create.json"
          },
          "Create a disk encryption set with key vault from a different subscription.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Create_WithKeyVaultFromADifferentSubscription.json"
          },
          "Create a disk encryption set with key vault from a different tenant.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Create_WithKeyVaultFromADifferentTenant.json"
          }
        },
        "x-ms-long-running-operation": true
      },
      "patch": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_Update",
        "description": "Updates (patches) a disk encryption set.",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "./diskRPCommon.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "#/parameters/DiskEncryptionSetNameParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          },
          {
            "name": "diskEncryptionSet",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSetUpdate"
            },
            "description": "disk encryption set object supplied in the body of the Patch disk encryption set operation."
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSet"
            }
          },
          "202": {
            "description": "Accepted",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSet"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "Update a disk encryption set.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Update.json"
          },
          "Update a disk encryption set with rotationToLatestKeyVersionEnabled set to true - Succeeded": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Update_WithRotationToLatestKeyVersionEnabled.json"
          },
          "Update a disk encryption set with rotationToLatestKeyVersionEnabled set to true - Updating": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Update_WithRotationToLatestKeyVersionEnabledInProgress.json"
          }
        },
        "x-ms-long-running-operation": true
      },
      "get": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_Get",
        "description": "Gets information about a disk encryption set.",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "./diskRPCommon.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "#/parameters/DiskEncryptionSetNameParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSet"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "Get information about a disk encryption set.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Get.json"
          },
          "Get information about a disk encryption set when auto-key rotation failed.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Get_WithAutoKeyRotationError.json"
          }
        }
      },
      "delete": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_Delete",
        "description": "Deletes a disk encryption set.",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "./diskRPCommon.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "#/parameters/DiskEncryptionSetNameParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "202": {
            "description": "Accepted"
          },
          "204": {
            "description": "If the disk encryption set is already deleted, this is an expected error code."
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "Delete a disk encryption set.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_Delete.json"
          }
        },
        "x-ms-long-running-operation": true
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets": {
      "get": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_ListByResourceGroup",
        "description": "Lists all the disk encryption sets under a resource group.",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "./diskRPCommon.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSetList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "List all disk encryption sets in a resource group.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_ListByResourceGroup.json"
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/providers/Microsoft.Compute/diskEncryptionSets": {
      "get": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_List",
        "description": "Lists all the disk encryption sets under a subscription.",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/DiskEncryptionSetList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "List all disk encryption sets in a subscription.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_ListBySubscription.json"
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/diskEncryptionSets/{diskEncryptionSetName}/associatedResources": {
      "get": {
        "tags": [
          "DiskEncryptionSets"
        ],
        "operationId": "DiskEncryptionSets_ListAssociatedResources",
        "description": "Lists all resources that are encrypted with this disk encryption set.",
        "parameters": [
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "./diskRPCommon.json#/parameters/ResourceGroupNameParameter"
          },
          {
            "$ref": "#/parameters/DiskEncryptionSetNameParameter"
          },
          {
            "$ref": "../../../common-types/v1/common.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ResourceUriList"
            }
          },
          "default": {
            "description": "Error response describing why the operation failed.",
            "schema": {
              "$ref": "../../../common-types/v1/common.json#/definitions/CloudError"
            }
          }
        },
        "x-ms-examples": {
          "List all resources that are encrypted with this disk encryption set.": {
            "$ref": "./examples/diskEncryptionSetExamples/DiskEncryptionSet_ListAssociatedResources.json"
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    }
  },
  "definitions": {
    "EncryptionSetProperties": {
      "properties": {
        "encryptionType": {
          "$ref": "#/definitions/DiskEncryptionSetType"
        },
        "activeKey": {
          "$ref": "#/definitions/KeyForDiskEncryptionSet",
          "description": "The key vault key which is currently used by this disk encryption set."
        },
        "previousKeys": {
          "type": "array",
          "readOnly": true,
          "items": {
            "$ref": "#/definitions/KeyForDiskEncryptionSet"
          },
          "x-ms-identifiers": [
            "sourceVault/id"
          ],
          "description": "A readonly collection of key vault keys previously used by this disk encryption set while a key rotation is in progress. It will be empty if there is no ongoing key rotation."
        },
        "provisioningState": {
          "readOnly": true,
          "type": "string",
          "description": "The disk encryption set provisioning state."
        },
        "rotationToLatestKeyVersionEnabled": {
          "type": "boolean",
          "description": "Set this flag to true to enable auto-updating of this disk encryption set to the latest key version."
        },
        "lastKeyRotationTimestamp": {
          "readOnly": true,
          "type": "string",
          "format": "date-time",
          "description": "The time when the active key of this disk encryption set was updated."
        },
        "autoKeyRotationError": {
          "readOnly": true,
          "$ref": "../../../common-types/v1/common.json#/definitions/ApiError",
          "description": "The error that was encountered during auto-key rotation. If an error is present, then auto-key rotation will not be attempted until the error on this disk encryption set is fixed."
        },
        "federatedClientId": {
          "type": "string",
          "description": "Multi-tenant application client id to access key vault in a different tenant. Setting the value to 'None' will clear the property."
        }
      }
    },
    "EncryptionSetIdentity": {
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "SystemAssigned",
            "UserAssigned",
            "SystemAssigned, UserAssigned",
            "None"
          ],
          "x-ms-enum": {
            "name": "DiskEncryptionSetIdentityType",
            "modelAsString": true
          },
          "description": "The type of Managed Identity used by the DiskEncryptionSet. Only SystemAssigned is supported for new creations. Disk Encryption Sets can be updated with Identity type None during migration of subscription to a new Azure Active Directory tenant; it will cause the encrypted resources to lose access to the keys."
        },
        "principalId": {
          "readOnly": true,
          "type": "string",
          "description": "The object id of the Managed Identity Resource. This will be sent to the RP from ARM via the x-ms-identity-principal-id header in the PUT request if the resource has a systemAssigned(implicit) identity"
        },
        "tenantId": {
          "readOnly": true,
          "type": "string",
          "description": "The tenant id of the Managed Identity Resource. This will be sent to the RP from ARM via the x-ms-client-tenant-id header in the PUT request if the resource has a systemAssigned(implicit) identity"
        },
        "userAssignedIdentities": {
          "$ref": "../../../common-types/v1/common.json#/definitions/UserAssignedIdentities",
          "description": "The list of user identities associated with the disk encryption set. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'."
        }
      },
      "description": "The managed identity for the disk encryption set. It should be given permission on the key vault before it can be used to encrypt disks."
    },
    "DiskEncryptionSetType": {
      "type": "string",
      "description": "The type of key used to encrypt the data of the disk.",
      "enum": [
        "EncryptionAtRestWithCustomerKey",
        "EncryptionAtRestWithPlatformAndCustomerKeys",
        "ConfidentialVmEncryptedWithCustomerKey"
      ],
      "x-ms-enum": {
        "name": "DiskEncryptionSetType",
        "modelAsString": true,
        "values": [
          {
            "value": "EncryptionAtRestWithCustomerKey",
            "description": "Resource using diskEncryptionSet would be encrypted at rest with Customer managed key that can be changed and revoked by a customer."
          },
          {
            "value": "EncryptionAtRestWithPlatformAndCustomerKeys",
            "description": "Resource using diskEncryptionSet would be encrypted at rest with two layers of encryption. One of the keys is Customer managed and the other key is Platform managed."
          },
          {
            "value": "ConfidentialVmEncryptedWithCustomerKey",
            "description": "Confidential VM supported disk and VM guest state would be encrypted with customer managed key."
          }
        ]
      }
    },
    "KeyForDiskEncryptionSet": {
      "properties": {
        "sourceVault": {
          "$ref": "./diskRPCommon.json#/definitions/SourceVault",
          "description": "Resource id of the KeyVault containing the key or secret. This property is optional and cannot be used if the KeyVault subscription is not the same as the Disk Encryption Set subscription."
        },
        "keyUrl": {
          "type": "string",
          "description": "Fully versioned Key Url pointing to a key in KeyVault. Version segment of the Url is required regardless of rotationToLatestKeyVersionEnabled value."
        }
      },
      "required": [
        "keyUrl"
      ],
      "description": "Key Vault Key Url to be used for server side encryption of Managed Disks and Snapshots"
    },
    "DiskEncryptionSet": {
      "properties": {
        "identity": {
          "$ref": "#/definitions/EncryptionSetIdentity"
        },
        "properties": {
          "x-ms-client-flatten": true,
          "$ref": "#/definitions/EncryptionSetProperties"
        }
      },
      "allOf": [
        {
          "$ref": "../../../common-types/v1/common.json#/definitions/Resource"
        }
      ],
      "description": "disk encryption set resource."
    },
    "DiskEncryptionSetUpdate": {
      "properties": {
        "properties": {
          "x-ms-client-flatten": true,
          "$ref": "#/definitions/DiskEncryptionSetUpdateProperties"
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Resource tags"
        },
        "identity": {
          "$ref": "#/definitions/EncryptionSetIdentity"
        }
      },
      "description": "disk encryption set update resource."
    },
    "DiskEncryptionSetUpdateProperties": {
      "properties": {
        "encryptionType": {
          "$ref": "#/definitions/DiskEncryptionSetType"
        },
        "activeKey": {
          "$ref": "#/definitions/KeyForDiskEncryptionSet"
        },
        "rotationToLatestKeyVersionEnabled": {
          "type": "boolean",
          "description": "Set this flag to true to enable auto-updating of this disk encryption set to the latest key version."
        },
        "federatedClientId": {
          "type": "string",
          "description": "Multi-tenant application client id to access key vault in a different tenant. Setting the value to 'None' will clear the property."
        }
      },
      "description": "disk encryption set resource update properties."
    },
    "DiskEncryptionSetList": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DiskEncryptionSet"
          },
          "description": "A list of disk encryption sets."
        },
        "nextLink": {
          "type": "string",
          "description": "The uri to fetch the next page of disk encryption sets. Call ListNext() with this to fetch the next page of disk encryption sets."
        }
      },
      "required": [
        "value"
      ],
      "description": "The List disk encryption set operation response."
    },
    "ResourceUriList": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "A list of IDs or Owner IDs of resources which are encrypted with the disk encryption set."
        },
        "nextLink": {
          "type": "string",
          "description": "The uri to fetch the next page of encrypted resources. Call ListNext() with this to fetch the next page of encrypted resources."
        }
      },
      "required": [
        "value"
      ],
      "description": "The List resources which are encrypted with the disk encryption set."
    }
  },
  "parameters": {
    "DiskEncryptionSetNameParameter": {
      "name": "diskEncryptionSetName",
      "in": "path",
      "required": true,
      "type": "string",
      "description": "The name of the disk encryption set that is being created. The name can't be changed after the disk encryption set is created. Supported characters for the name are a-z, A-Z, 0-9, _ and -. The maximum name length is 80 characters.",
      "x-ms-parameter-location": "method"
    }
  }
}