Share via

Clone encrypted disk and attach it to another VM

Vicent Alemany (AuraQuantic) 1 Reputation point
2020-11-05T11:02:00.177+00:00

We have a VM with all the disks encrypted and the goal is to "clone" one of the data disks and attach it to another VM (same region)

We tried several approaches without success, but it would be better to achieve it quickly since we must perform this action monthly in a production environment.

The disk is quite large (3TB), is there a way to achieve it?

If it can be automated using a PowerShell script, or at least the part of the disk cloning ready to connect to the other VM, that will be great .

Thanks in advance.

Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. deherman-MSFT 34,196 Reputation points Microsoft Employee
    2020-11-05T16:42:38.097+00:00

    @VicentAlemanyAuraPortalAuraQuantic-0135
    The easiest method would be to create a snapshot of the disk and then use that snapshot to create a managed disk. If your backups are incremental you can consider using incremental snapshots, which might save on cost and backup time.

    Please try this out and let us know if it works for your use case. If you run into any issues please let us know.

    -------------------------------

    Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

  2. deherman-MSFT 34,196 Reputation points Microsoft Employee
    2020-11-09T20:02:07.507+00:00

    @Vicent Alemany (AuraQuantic)
    After creating a disk from the snapshot and attaching it to your new VM you can then enable encryption on the new VM with the same key vault. After this completes your disk should be accessible from the new VM. Please check and see if this works for your use-case. If not, please answer these questions so I have a better understanding of your use-case:

    1.Why do you want to have two copies of an encrypted data disk on two separate VMs?
    2.Will this second VM be encrypted using the same key vault? If not, this won't work unless you download the BEK or KEK.
    3.What type of encryption are you using? BEK, KEK, SSE+CMK?

    Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.