サービスプリンシパルを使いAzure Windows 仮想マシンをAzure Arc に登録する

# Azure Arc用のリソースプロバイダーを登録する
az provider register --namespace 'Microsoft.HybridCompute'
az provider register --namespace 'Microsoft.GuestConfiguration'
az provider register --namespace 'Microsoft.HybridConnectivity'

# 以下リソースプロバイダーは必要に応じて登録する
az provider register --namespace 'Microsoft.AzureArcData'
az provider register --namespace 'Microsoft.Compute'

# 変数を格納する
RESOURCE_GROUP_NAME="rg-azurearctest"
VIRTUAL_MACHINE_NAME="vm-azurearctest"
VIRTUAL_MACHINE_IMAGE="win2022datacenter"
VIRTUAL_MACHINE_ADMIN_NAME="hogehoge"
VIRTUAL_MACHINE_ADMIN_PASSWORD="a_HOe&kIse-2Tuh7"
LOCATION="japaneast"

# リソースグループを作成する
az group create --name $RESOURCE_GROUP_NAME --location $LOCATION

# Windows仮想マシンを作成する
# RDP接続用に接続するためpublicIpAddressの値を控えておく
az vm create --name $VIRTUAL_MACHINE_NAME \
    --resource-group $RESOURCE_GROUP_NAME \
    --location $LOCATION \
    --image $VIRTUAL_MACHINE_IMAGE \
    --admin-username $VIRTUAL_MACHINE_ADMIN_NAME \
    --admin-password $VIRTUAL_MACHINE_ADMIN_PASSWORD

try {
    $ServicePrincipalId="xxxxxxxx-xxxxxxxxx-xxxx-xxxxxxxxxxxx";
    $ServicePrincipalClientSecret="<サービスプリンシパル作成時にダウンロードしたシークレット値>";

    $env:SUBSCRIPTION_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
    $env:RESOURCE_GROUP = "rg-vmtest";
    $env:TENANT_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
    $env:LOCATION = "japaneast";
    $env:AUTH_TYPE = "principal";
    $env:CORRELATION_ID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
    $env:CLOUD = "AzureCloud";
    

    [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072;
    Invoke-WebRequest -UseBasicParsing -Uri "https://aka.ms/azcmagent-windows" -TimeoutSec 30 -OutFile "$env:TEMP\install_windows_azcmagent.ps1";
    & "$env:TEMP\install_windows_azcmagent.ps1";
    if ($LASTEXITCODE -ne 0) { exit 1; }
    & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" connect --service-principal-id "$ServicePrincipalId" --service-principal-secret "$ServicePrincipalClientSecret" --resource-group "$env:RESOURCE_GROUP" --tenant-id "$env:TENANT_ID" --location "$env:LOCATION" --subscription-id "$env:SUBSCRIPTION_ID" --cloud "$env:CLOUD" --tags "Datacenter=japandc,City=Tokyo,StateOrDistrict=2024-05-04,CountryOrRegion=japaneast" --correlation-id "$env:CORRELATION_ID";
}
catch {
    $logBody = @{subscriptionId="$env:SUBSCRIPTION_ID";resourceGroup="$env:RESOURCE_GROUP";tenantId="$env:TENANT_ID";location="$env:LOCATION";correlationId="$env:CORRELATION_ID";authType="$env:AUTH_TYPE";operation="onboarding";messageType=$_.FullyQualifiedErrorId;message="$_";};
    Invoke-WebRequest -UseBasicParsing -Uri "https://gbl.his.arc.azure.com/log" -Method "PUT" -Body ($logBody | ConvertTo-Json) | out-null;
    Write-Host  -ForegroundColor red $_.Exception;
}

# Azure VMの拡張機能を削除する
az vm extension delete -g <リソースグループ名> --vm-name <対象VM名> -n <削除する拡張機能名>

# VMエージェントサービスを停止する
Set-Service WindowsAzureGuestAgent -StartupType Disabled -Verbose
Stop-Service WindowsAzureGuestAgent -Force -Verbose

# Azure Instance Metadata Service (IMDS) をブロックするFirewallルールを作成
# こちらをブロックしておかないとConnected machineエージェント実行時にエラーとなる
New-NetFirewallRule -Name BlockAzureIMDS -DisplayName "Block access to Azure IMDS" -Enabled True -Profile Any -Direction Outbound -Action Block -RemoteAddress 169.254.169.254

PS C:\Users\hogehoge\Desktop> .\test.ps1
VERBOSE: Installing Azure Connected Machine Agent
VERBOSE: Total Physical Memory:     8,191 MB
VERBOSE: PowerShell version: 5.1.20348.2400
VERBOSE: .NET Framework version: 4.8.4161
VERBOSE: Checking if this is an Azure virtual machine
VERBOSE: Error Unable to connect to the remote server checking if we are in Azure
VERBOSE: Downloading agent package from https://aka.ms/AzureConnectedMachineAgent to
C:\Users\HOGEHO~1\AppData\Local\Temp\2\AzureConnectedMachineAgent.msi
VERBOSE: Installing agent package
Installation of azcmagent completed successfully
INFO    Connecting machine to Azure... This might take a few minutes.
INFO    Testing connectivity to endpoints that are needed to connect to Azure... This might take a few minutes.
  20% [==>            ]
  30% [===>           ]
  INFO    Creating resource in Azure...                 Correlation ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Resource ID=/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-azurearctest/providers/Microsoft.HybridCompute/machines/vm-azurearctest
  60% [========>      ]
  80% [===========>   ]
 100% [===============]
  INFO    Connected machine to Azure
INFO    Machine overview page: https://portal.azure.com/#@xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resource/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-azurearctest/providers/Microsoft.HybridCompute/machines/vm-azurearctest/overview

# Connected machineエージェントを切断する
azcmagent disconnect

# リソースグループを削除する
az group delete --name rg-azurearctest