Virtual Machine plugin for Azure Marketplace Generator with High Availability Clusters, Azure SDK Integration, Workbooks, Cost Optimization, Disaster Recovery, Extensions, Security, Identity, Enterprise Scaling, and Azure Monitor Observability features
npm install @hoiltd/azmp-plugin-vmComprehensive Virtual Machine plugin for Azure Marketplace Generator with advanced networking, extensions, security, and identity features.


- ๐ฅ๏ธ VM Configuration - 40+ VM sizes, 20+ OS images, storage configuration
- ๐ Advanced Networking - VNets, subnets, NSGs, load balancers, Application Gateway, Bastion, VNet peering
- ๐ VM Extensions - 20 extensions (Windows, Linux, cross-platform)
- ๐ Security - Disk encryption (ADE, SSE, Encryption at Host), Trusted Launch
- ๐ Identity & Access - Managed Identity, Azure AD integration, RBAC
- โก High Availability - Availability Sets, Availability Zones, VMSS with SLA calculations
- ๐ Disaster Recovery - Azure Backup, Site Recovery, Snapshots with retention policies
- ๐ Enterprise Scaling - VMSS (Uniform/Flexible), Auto-scaling (metric/schedule), Multi-region with Traffic Manager, Load Balancing (Standard LB, App Gateway v2)
- ๐ Compliance - SOC 2, PCI-DSS, HIPAA, ISO 27001, NIST 800-53, FedRAMP
- ๐จ 170+ Handlebars Helpers - Comprehensive template generation (50+ scaling/HA/DR helpers)
- ๐ป 44 CLI Commands - Rich command-line interface (12 new HA/DR commands)
``bash`
npm install @hoiltd/azmp-plugin-vmCurrent version: 2.1.0
Includes: ARM-TTK compliance, comprehensive testing, marketplace certification
Add to your azmp-config.json:
`json`
{
"plugins": [
{
"package": "@hoiltd/azmp-plugin-vm",
"enabled": true,
"options": {
"defaultVmSize": "Standard_D2s_v3",
"includeDiagnostics": true,
"includePublicIp": true,
"security": {
"enableTrustedLaunch": true,
"enableDiskEncryption": true
},
"identity": {
"type": "SystemAssigned"
}
}
}
]
}
CommonJS:
`javascript
const { VmPlugin } = require("@hoiltd/azmp-plugin-vm");
const plugin = new VmPlugin({
defaultVmSize: "Standard_D2s_v3",
includeDiagnostics: true,
});
// Initialize with context
await plugin.initialize({
logger: console,
generatorVersion: "3.1.0",
templatesDir: "./templates",
outputDir: "./output",
config: {},
});
// Get available templates
const templates = plugin.getTemplates();
// Register CLI commands
const { Command } = require("commander");
const program = new Command();
plugin.registerCommands(program);
`
ES Modules:
`javascript
import { VmPlugin } from "@hoiltd/azmp-plugin-vm";
const plugin = new VmPlugin({
defaultVmSize: "Standard_D2s_v3",
includeDiagnostics: true,
});
await plugin.initialize({
logger: console,
generatorVersion: "3.1.0",
templatesDir: "./templates",
outputDir: "./output",
config: {},
});
`
Trusted Launch is now enabled by default for enhanced VM security:
- โ
Secure Boot - Protects against rootkits and bootkits
- โ
vTPM - Virtual Trusted Platform Module for measured boot
- โ
Zero Configuration - Works automatically with Generation 2 VMs
- โ
Compliance Ready - Meets requirements for security frameworks
๐ Read more about Trusted Launch enhancement โ
Three high-impact features for production workloads:
- SR-IOV for up to 30 Gbps network throughput
- Significantly reduced latency and jitter
- Ideal for: HPC, databases, high-throughput applications
- Auto-enabled for supported VM sizes
`json`
{
"enableAcceleratedNetworking": true
}
- Secure Boot: Validates boot chain integrity
- vTPM: Enables attestation and BitLocker encryption
- Protection against boot kits, rootkits, kernel malware
- Required for: Zero-trust architectures, compliance frameworks
- Requires: Generation 2 VM images
`json`
{
"securityType": "TrustedLaunch",
"secureBootEnabled": true,
"vTpmEnabled": true
}
- Serial console output capture
- Boot screenshot for visual troubleshooting
- Essential for: Kernel panics, boot failures, rapid incident resolution
- Managed storage (no config needed) or custom storage account
`json`
{
"bootDiagnosticsEnabled": true,
"bootDiagnosticsStorageUri": "" // Empty = managed storage
}
Example Configurations:
- examples/trusted-launch-config.json - Full security baseline
- examples/accelerated-networking-config.json - High-performance networking
- examples/boot-diagnostics-config.json - Enhanced supportability
Production-ready release with comprehensive testing and marketplace certification:
- Full Azure Resource Manager Template Toolkit validation
- Marketplace certification ready templates
- Enhanced parameter validation and defaults
- Comprehensive UI/UX improvements
- 801 passing tests (92% of 872 total test suite)
- VHD validation testing (requires integration fixtures)
- Diagnostics retention validation fixes
- Coverage baseline: 40% statements, 34% branches
- ARM-TTK compliant parameter definitions
- Microsoft.Network API version updates
- Blank value compliance for optional parameters
- Output definitions for all deployments
Note: VHD validation tests are skipped in CI as they require actual VHD files (30GB+ minimum). These tests are designed for integration testing with real fixtures in staging environments.
Two powerful features to reduce Azure spending:
- 30-40% faster VM provisioning (no remote disk writes)
- Lower storage costs - no persistent OS disk charges
- Uses local VM cache or temp storage (no Azure Storage overhead)
- Ideal for: Stateless workloads, CI/CD agents, scale sets, dev/test
- Requires: Premium_LRS or StandardSSD_LRS, supported VM sizes
`json`
{
"useEphemeralOSDisk": true,
"ephemeralDiskPlacement": "CacheDisk" // or "ResourceDisk"
}
Placement Options:
- CacheDisk: Uses VM cache (most common, better performance)ResourceDisk
- : Uses temporary storage disk (for VMs with limited cache)
- Up to 70% cost savings on dev/test VMs
- Automatic daily shutdown with configurable time & timezone
- Email notifications 30 minutes before shutdown
- Zero compute charges when stopped (still pays for storage)
- DevTest Labs integration - no custom scripts needed
`json`
{
"enableAutoShutdown": true,
"autoShutdownTime": "1900", // 7:00 PM in 24-hour format
"autoShutdownTimeZone": "Pacific Standard Time",
"autoShutdownNotificationEmail": "devteam@example.com"
}
Common Time Zones:
- UTC - Coordinated Universal TimePacific Standard Time
- - US West CoastEastern Standard Time
- - US East CoastGMT Standard Time
- - LondonCentral European Standard Time
- - Paris, Berlin
Example Configurations:
- examples/ephemeral-disk-config.json - Fast provisioning with ephemeral disks
- examples/auto-shutdown-config.json - Dev/test cost savings
- examples/full-cost-optimization-config.json - Combined cost controls
`bashCreate a VM marketplace offer
azmp create vm --name myvm --location eastus
$3
`bash
List VNet templates
azmp vm network list-vnet-templates --type hubList subnet patterns
azmp vm network list-subnet-patterns --search webList service endpoints
azmp vm network list-service-endpointsList NSG rules
azmp vm network list-nsg-rules --port 443List NSG templates
azmp vm network list-nsg-templates --tier webList load balancer templates
azmp vm network list-lb-templates --type internalList health probes
azmp vm network list-health-probes --protocol httpsList Application Gateway templates
azmp vm network list-appgw-templates --waf-enabledList Bastion templates
azmp vm network list-bastion-templates --sku standardList VNet peering templates
azmp vm network list-peering-templates --topology hub-spoke
`$3
`bash
List all VM extensions
azmp vm extList Windows extensions
azmp vm ext list-windowsList Linux extensions
azmp vm ext list-linuxList cross-platform extensions
azmp vm ext list-crossplatform
`$3
`bash
List all security features
azmp vm security listList encryption types
azmp vm security list-encryptionList Trusted Launch features
azmp vm security list-trusted-launchList compliance frameworks
azmp vm security list-compliance
`$3
`bash
List all identity features
azmp vm identity listList managed identity types
azmp vm identity list-managed-identityList Azure AD features
azmp vm identity list-aad-featuresList RBAC roles
azmp vm identity list-rbac-roles
`$3
`bash
List availability zones for a region
azmp availability list-zones --region eastusCheck if region supports availability zones
azmp availability check-zone-support --region westusCalculate SLA for availability configuration
azmp availability calculate-sla --type zone
azmp availability calculate-sla --type set
azmp availability calculate-sla --type vmss --orchestration FlexibleRecommend high availability configuration
azmp availability recommend-config --vm-count 3 --criticality high
`$3
`bash
Estimate backup storage requirements
azmp recovery estimate-backup --vm-size 128 --change-rate 0.05 --retention 30List Azure region pairs for disaster recovery
azmp recovery list-region-pairs
azmp recovery list-region-pairs --region eastusEstimate Recovery Time Objective
azmp recovery estimate-rto --vm-count 5 --avg-size 128List backup policy presets
azmp recovery list-backup-presetsList snapshot retention policies
azmp recovery list-snapshot-policiesRecommend snapshot schedule based on workload
azmp recovery recommend-snapshot-schedule --criticality high --change-frequency medium
`Configuration Options
| Option | Type | Default | Description |
| --------------------------------- | ------- | ----------------- | --------------------------------------------------------------------------------------------------- |
|
defaultVmSize | string | Standard_D2s_v3 | Default VM size |
| includeDiagnostics | boolean | true | Include boot diagnostics |
| includePublicIp | boolean | true | Create public IP address |
| includeNsg | boolean | true | Create Network Security Group |
| enableAcceleratedNetworking | boolean | true | Enable SR-IOV for up to 30 Gbps throughput (requires supported VM size) |
| bootDiagnosticsEnabled | boolean | true | Enable boot diagnostics for troubleshooting (serial console + screenshots) |
| bootDiagnosticsStorageUri | string | - | Custom storage URI for boot diagnostics (leave empty for managed storage) |
| securityType | string | TrustedLaunch | Security type: TrustedLaunch, Standard (requires Gen2 VM images) |
| secureBootEnabled | boolean | true | Enable UEFI Secure Boot (requires TrustedLaunch security type) |
| vTpmEnabled | boolean | true | Enable virtual TPM device (requires TrustedLaunch security type) |
| useEphemeralOSDisk | boolean | false | Use ephemeral OS disk for faster provisioning and lower cost (requires Premium_LRS/StandardSSD_LRS) |
| ephemeralDiskPlacement | string | CacheDisk | Ephemeral disk placement: CacheDisk (VM cache) or ResourceDisk (temp storage) |
| enableAutoShutdown | boolean | false | Enable automatic shutdown schedule for cost savings (recommended for dev/test) |
| autoShutdownTime | string | 1900 | Daily shutdown time in 24-hour format (e.g., 1900 for 7:00 PM) |
| autoShutdownTimeZone | string | UTC | Time zone for shutdown schedule (e.g., 'Pacific Standard Time', 'UTC') |
| autoShutdownNotificationEmail | string | - | Email address for shutdown notifications (optional, sends alert 30 min before) |
| security.enableTrustedLaunch | boolean | true | Enable Trusted Launch (Gen 2 VMs) Default: ON |
| security.enableDiskEncryption | boolean | false | Enable Azure Disk Encryption |
| security.encryptionType | string | ade | Encryption type: ade, sse-pmk, sse-cmk, encryption-at-host |
| identity.type | string | None | Identity type: SystemAssigned, UserAssigned, SystemAssigned,UserAssigned, None |
| identity.userAssignedIdentityId | string | - | User-assigned identity resource ID |Handlebars Helpers
$3
####
vmSizeGet VM size configuration with details.
`handlebars
{{vmSize "Standard_D2s_v3"}}
`####
vmImageGet VM image reference for OS deployment.
`handlebars
{{vmImage "Ubuntu" "22.04-LTS"}}
`####
vmStorageGet storage configuration for disks.
`handlebars
{{vmStorage "Premium_LRS" "ReadWrite"}}
`$3
#### VNet & Subnet Helpers (23 helpers)
`handlebars
{{vnet-template "hub"}}
{{vnet-address-space "10.0.0.0/16"}}
{{vnet-service-endpoints "Microsoft.Storage" "Microsoft.KeyVault"}}
{{subnet-pattern "web"}}
{{subnet-calculate-ips "10.0.1.0/24"}}
{{subnet-validate-cidr "10.0.0.0/16"}}
{{subnet-overlaps "10.0.1.0/24" "10.0.2.0/24"}}
`#### NSG Helpers (14 helpers)
`handlebars
{{nsg-rule "allow-https"}}
{{nsg-template "web"}}
{{nsg-validate-priority 100}}
{{nsg-service-tag "Internet"}}
{{nsg-create-rule
name="allow-app"
priority=200
direction="Inbound"
access="Allow"
protocol="Tcp"
sourceAddressPrefix="10.0.1.0/24"
destinationPortRange="8080"
}}
`#### Load Balancer Helpers (17 helpers)
`handlebars
{{lb-template "internal"}}
{{lb-health-probe "http"}}
{{lb-rule "web-http"}}
{{lb-nat-rule "rdp"}}
{{lb-validate-probe-interval 15 2}}
`#### Application Gateway Helpers (10 helpers)
`handlebars
{{appgw-template "waf-enabled"}}
{{appgw-http-settings "default"}}
{{appgw-listener "https"}}
{{appgw-url-path-map "/api" "api-backend"}}
{{appgw-validate-capacity 2 10}}
`#### Bastion Helpers (9 helpers)
`handlebars
{{bastion-template "standard"}}
{{bastion-feature "tunneling"}}
{{bastion-feature-available "file-copy" "Premium"}}
{{bastion-recommended-scale 100}}
`#### VNet Peering Helpers (9 helpers)
`handlebars
{{peering-template "hub-spoke"}}
{{peering-hub-spoke "single-hub" 3}}
{{peering-scenario "dev-prod-isolation"}}
{{peering-mesh-count 5}}
`$3
`handlebars
{{ext:windows "CustomScript"}}
{{ext:windows "DSC"}}
{{ext:windows "IIS"}}
{{ext:windows "Antimalware"}}
{{ext:windows "DomainJoin"}}
{{ext:windows "KeyVault"}}
{{ext:windows "BGInfo"}}
{{ext:windows "Chef"}}
{{ext:linux "CustomScript"}}
{{ext:linux "CloudInit"}}
{{ext:linux "Docker"}}
{{ext:linux "AADSSHLogin"}}
{{ext:linux "NetworkWatcher"}}
{{ext:linux "Diagnostics"}}
{{ext:linux "Backup"}}
{{ext:crossplatform "AzureMonitor"}}
{{ext:crossplatform "DependencyAgent"}}
{{ext:crossplatform "GuestConfiguration"}}
{{ext:crossplatform "ApplicationHealth"}}
{{ext:crossplatform "DiskEncryption"}}
{{ext:list "windows"}}
{{ext:template "CustomScript"}}
{{ext:count "linux"}}
{{ext:filter-by-feature "monitoring"}}
{{ext:dependencies "Docker"}}
{{ext:multi-extension "AzureMonitor" "DependencyAgent"}}
{{ext:script
platform="linux"
scriptUrl="https://example.com/setup.sh"
commandToExecute="bash setup.sh"
}}
{{ext:domain-join
domain="contoso.com"
ouPath="OU=Servers,DC=contoso,DC=com"
user="admin@contoso.com"
}}
{{ext:antimalware realtimeProtection=true scheduledScan=true scanType="Quick"}}
{{ext:docker
dockerComposeYml="version: '3'\nservices:\n web:\n image: nginx"
}}
{{ext:monitor workspaceId="workspace-id" workspaceKey="workspace-key"}}
`$3
#### Encryption Helpers
`handlebars
{{security:ade
keyVaultResourceId="/subscriptions/.../Microsoft.KeyVault/vaults/mykeyvault"
keyVaultUrl="https://mykeyvault.vault.azure.net/"
volumeType="All"
}}
{{security:sse-pmk}}
{{security:sse-cmk
keyVaultResourceId="/subscriptions/.../Microsoft.KeyVault/vaults/mykeyvault"
keyUrl="https://mykeyvault.vault.azure.net/keys/mykey/version"
}}
{{security:encryption-at-host}}
`#### Trusted Launch Helpers
`handlebars
{{security:trusted-launch}}
{{security:secure-boot}}
{{security:vtpm}}
{{security:boot-integrity}}
{{security:guest-attestation}}
{{security:defender}}
`#### Security Template Helpers
`handlebars
{{security:template "maximum-security"}}
{{security:template "basic-security"}}
{{security:template "enhanced-security"}}
{{security:compliance "SOC2"}}
{{security:compliance "PCI-DSS"}}
{{security:compliance "HIPAA"}}
{{security:compliance "ISO-27001"}}
{{security:compliance "NIST"}}
{{security:compliance "FedRAMP"}}
{{security:list}}
{{security:list "encryption"}}
{{security:list "trusted-launch"}}
{{security:count "encryption"}}
{{security:count "trusted-launch"}}
{{security:validate config}}
{{security:recommend "high-security"}}
{{security:recommend "compliance"}}
{{security:recommend "basic"}}
`$3
#### Managed Identity Helpers (7 helpers)
`handlebars
{{identity:managedidentity.systemAssigned}}
{{identity:managedidentity.userAssigned
identityId="/subscriptions/.../Microsoft.ManagedIdentity/userAssignedIdentities/myidentity"
}}
{{identity:managedidentity.multiple
userIdentityIds=(array
"/subscriptions/.../userAssignedIdentities/identity1"
"/subscriptions/.../userAssignedIdentities/identity2"
)
}}
{{identity:managedidentity.create
name="myidentity"
location="eastus"
tags=(object name="Environment" value="Production")
}}
{{identity:managedidentity.recommendations "key-vault"}}
{{identity:managedidentity.recommendations "storage"}}
{{identity:managedidentity.recommendations "sql"}}
{{identity:managedidentity.recommendations "multi-service"}}
{{identity:managedidentity.validate config}}
{{identity:managedidentity.roleAssignment
principalId="identity-principal-id"
roleDefinitionId="built-in-role-id"
scope="/subscriptions/.../resourceGroups/myrg"
}}
`#### Azure AD Helpers (8 helpers)
`handlebars
{{identity:azuread.sshLogin}}
{{identity:azuread.windowsLogin}}
{{identity:azuread.conditionalAccess
requireMfa=true
requireCompliantDevice=true
allowedLocations=(array "US" "EU")
}}
{{identity:azuread.mfa methods=(array "phone" "authenticator") required=true}}
{{identity:azuread.passwordless methods=(array "fido2" "windowsHello")}}
{{identity:azuread.vmAccessRole "administrator"}}
{{identity:azuread.vmAccessRole "user"}}
{{identity:azuread.create
platform="linux"
features=(array "sshLogin" "mfa" "conditionalAccess")
}}
{{identity:azuread.validate config}}
`#### RBAC Helpers (13 helpers)
`handlebars
{{identity:rbac.assignBuiltInRole
principalId="identity-principal-id"
roleName="Contributor"
scopeType="resourceGroup"
scopeId="myrg"
}}
{{identity:rbac.createCustomRole
name="VM Operator"
description="Can start and stop VMs"
actions=(array
"Microsoft.Compute/virtualMachines/start/action"
"Microsoft.Compute/virtualMachines/powerOff/action"
)
assignableScopes=(array "/subscriptions/sub-id")
}}
{{identity:rbac.scope "resourceGroup" "myrg"}}
{{identity:rbac.scope "subscription" "sub-id"}}
{{identity:rbac.scope "resource" "myvm"}}
{{identity:rbac.template assignment}}
{{identity:rbac.recommend
requiredActions=(array
"Microsoft.Storage/storageAccounts/read"
"Microsoft.Storage/storageAccounts/listKeys/action"
)
}}
{{identity:rbac.vmStartStopOperator}}
{{identity:rbac.vmBackupOperator}}
{{identity:rbac.vmNetworkConfigurator}}
{{identity:rbac.vmMonitorReader}}
{{identity:rbac.vmExtensionManager}}
{{identity:rbac.validate assignment}}
{{identity:rbac.bestPractices}}
{{identity:rbac.builtInRole "Contributor"}}
`#### Identity Utility Helpers (5 helpers)
`handlebars
{{identity:list}}
{{identity:list "managed-identity"}}
{{identity:list "azure-ad"}}
{{identity:list "rbac"}}
{{identity:template "system-assigned-identity"}}
{{identity:template "aad-ssh-login"}}
{{identity:template "rbac-least-privilege"}}
{{identity:template "compliance-soc2"}}
{{identity:count "managed-identity"}}
{{identity:count "azure-ad"}}
{{identity:count "rbac"}}
{{identity:filterByFeature "passwordless"}}
{{identity:compliance "SOC2"}}
{{identity:compliance "HIPAA"}}
`$3
#### VMSS (Virtual Machine Scale Sets) Helpers (1 helper)
`handlebars
{{scale:vmss.definition
name="webVmss"
orchestrationMode="Flexible"
upgradeMode="Rolling"
instanceCount=3
vmSize="Standard_D2s_v3"
osType="Linux"
imagePublisher="Canonical"
imageOffer="0001-com-ubuntu-server-jammy"
imageSku="22_04-lts-gen2"
adminUsername="azureuser"
authenticationType="password"
enableAutoOsUpgrade=true
healthProbeId="[resourceId('Microsoft.Network/loadBalancers/probes', 'myLb', 'http')]"
maxBatchInstancePercent=20
maxUnhealthyInstancePercent=20
maxUnhealthyUpgradedInstancePercent=20
pauseTimeBetweenBatches="PT5S"
}}
`#### Auto-scaling Helpers (5 helpers)
`handlebars
{{scale:autoscale.policy
vmssResourceId="[resourceId('Microsoft.Compute/virtualMachineScaleSets', 'myVmss')]"
minCapacity=2
maxCapacity=10
defaultCapacity=3
rules=(array metricRule scheduleRule)
}}
{{scale:autoscale.metricRule
metricName="Percentage CPU"
operator="GreaterThan"
threshold=75
scaleAction="Increase"
cooldown="PT5M"
}}
{{scale:autoscale.scheduleProfile
startTime="2024-01-01T08:00:00"
endTime="2024-12-31T18:00:00"
recurrence=(object
frequency="Week"
schedule=(object
days=(array "Monday" "Tuesday" "Wednesday" "Thursday" "Friday")
)
)
minCapacity=5
maxCapacity=20
defaultCapacity=10
}}
{{scale:autoscale.cpu
vmssResourceId="[resourceId('Microsoft.Compute/virtualMachineScaleSets', 'myVmss')]"
minCapacity=2
maxCapacity=10
defaultCapacity=3
scaleOutThreshold=75
scaleInThreshold=25
}}
{{scale:autoscale.businessHours
minCapacity=5
maxCapacity=20
defaultCapacity=10
timezone="Pacific Standard Time"
}}
`#### Multi-Region Helpers (4 helpers)
`handlebars
{{scale:multiregion.profile
profileName="globalApp"
dnsName="globalapp-tm"
routingMethod="Performance"
monitorProtocol="HTTPS"
monitorPort=443
monitorPath="/"
}}
{{scale:multiregion.endpoint
endpointName="eastus-endpoint"
type="azureEndpoints"
targetResourceId="[resourceId('Microsoft.Network/publicIPAddresses', 'eastus-pip')]"
priority=1
weight=100
endpointLocation="East US"
}}
{{scale:multiregion.deploymentPlan
primaryRegion="East US"
secondaryRegions=(array "West US" "North Europe")
replicationStrategy="active-active"
dataSync="async"
}}
{{scale:multiregion.failover
primaryRegion="East US"
failoverRegion="West US"
rto=60
rpo=15
automaticFailover=true
}}
`#### Load Balancing Helpers (4 helpers)
`handlebars
{{scale:lb.definition
name="webLb"
sku="Standard"
tier="Regional"
frontendIpName="webFrontend"
publicIpResourceId="[resourceId('Microsoft.Network/publicIPAddresses', 'webPip')]"
backendPoolName="webBackend"
probeName="httpProbe"
probeProtocol="Http"
probePort=80
probePath="/"
ruleName="httpRule"
ruleProtocol="Tcp"
ruleFrontendPort=80
ruleBackendPort=80
enableFloatingIp=false
idleTimeoutInMinutes=4
}}
{{scale:lb.probe
name="httpsProbe"
protocol="Https"
port=443
path="/health"
intervalInSeconds=15
numberOfProbes=2
}}
{{scale:lb.recommendHealthProbe "web-application"}}
{{scale:lb.recommendHealthProbe "api-service"}}
{{scale:lb.recommendHealthProbe "database"}}
{{scale:appgw.definition
name="webAppGw"
tier="Standard_v2"
capacity=2
autoScaleMinCapacity=2
autoScaleMaxCapacity=10
enableWaf=false
frontendPort=80
backendPort=80
protocol="Http"
backendAddresses=(array "10.0.1.4" "10.0.1.5")
cookieBasedAffinity="Disabled"
requestTimeout=30
}}
{{scale:appgw.recommendSku
expectedTraffic="high"
wafRequired=true
autoScaleEnabled=true
}}
`Usage Examples
$3
`handlebars
{ "type": "Microsoft.Compute/virtualMachines", "apiVersion": "2023-03-01",
"name": "[parameters('vmName')]", "location": "[parameters('location')]",
"identity":
{{identity:managedidentity.systemAssigned}}, "properties": { "hardwareProfile":
{{vmSize "Standard_D2s_v3"}}, "osProfile": { "computerName":
"[parameters('vmName')]", "adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]" }, "storageProfile": {
"imageReference":
{{vmImage "Ubuntu" "22.04-LTS"}}, "osDisk": { "createOption": "FromImage",
"managedDisk":
{{security:sse-cmk
keyVaultResourceId="[parameters('keyVaultId')]"
keyUrl="[parameters('keyUrl')]"
}}
} }, "securityProfile":
{{security:trusted-launch}}, "networkProfile": { "networkInterfaces": [ { "id":
"[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]" } ]
} } }
`$3
`handlebars
{ "type": "Microsoft.Compute/virtualMachines/extensions", "apiVersion":
"2023-03-01", "name": "[concat(parameters('vmName'),
'/AzureMonitorLinuxAgent')]", "location": "[parameters('location')]",
"dependsOn": [ "[resourceId('Microsoft.Compute/virtualMachines',
parameters('vmName'))]" ], "properties":
{{ext:monitor
workspaceId="[parameters('workspaceId')]"
workspaceKey="[parameters('workspaceKey')]"
}}
}
`$3
`handlebars
{ "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01",
"name": "[guid(resourceGroup().id, parameters('principalId'), 'Contributor')]",
"properties":
{{identity:rbac.assignBuiltInRole
principalId="[parameters('principalId')]"
roleName="Contributor"
scopeType="resourceGroup"
scopeId="[resourceGroup().name]"
}}
}
`$3
`handlebars
{ "type": "Microsoft.Compute/virtualMachineScaleSets", "apiVersion":
"2023-09-01", "name": "[parameters('vmssName')]", "location":
"[parameters('location')]", "sku": { "name": "[parameters('vmSize')]", "tier":
"Standard", "capacity": "[parameters('instanceCount')]" }, "properties":
{{scale:vmss.definition
name="[parameters('vmssName')]"
orchestrationMode="Flexible"
upgradeMode="Rolling"
instanceCount="[parameters('instanceCount')]"
vmSize="[parameters('vmSize')]"
osType="Linux"
imagePublisher="Canonical"
imageOffer="0001-com-ubuntu-server-jammy"
imageSku="22_04-lts-gen2"
adminUsername="[parameters('adminUsername')]"
authenticationType="password"
enableAutoOsUpgrade=true
healthProbeId="[resourceId('Microsoft.Network/loadBalancers/probes', parameters('lbName'), 'httpProbe')]"
maxBatchInstancePercent=20
maxUnhealthyInstancePercent=20
maxUnhealthyUpgradedInstancePercent=20
pauseTimeBetweenBatches="PT5S"
}}
}, { "type": "Microsoft.Insights/autoscalesettings", "apiVersion": "2022-10-01",
"name": "[concat(parameters('vmssName'), '-autoscale')]", "location":
"[parameters('location')]", "dependsOn": [
"[resourceId('Microsoft.Compute/virtualMachineScaleSets',
parameters('vmssName'))]" ], "properties":
{{scale:autoscale.cpu
vmssResourceId="[resourceId('Microsoft.Compute/virtualMachineScaleSets', parameters('vmssName'))]"
minCapacity=2
maxCapacity=10
defaultCapacity=3
scaleOutThreshold=75
scaleInThreshold=25
}}
}
`$3
`handlebars
{ "type": "Microsoft.Network/trafficManagerProfiles", "apiVersion":
"2022-04-01", "name": "[parameters('trafficManagerName')]", "location":
"global", "properties":
{{scale:multiregion.profile
profileName="[parameters('trafficManagerName')]"
dnsName="[parameters('dnsName')]"
routingMethod="Performance"
monitorProtocol="HTTPS"
monitorPort=443
monitorPath="/health"
}}, "resources": [ { "type": "endpoints", "apiVersion": "2022-04-01", "name":
"eastus-endpoint", "dependsOn": [
"[resourceId('Microsoft.Network/trafficManagerProfiles',
parameters('trafficManagerName'))]" ], "properties":
{{scale:multiregion.endpoint
endpointName="eastus-endpoint"
type="azureEndpoints"
targetResourceId="[resourceId('Microsoft.Network/publicIPAddresses', 'eastus-pip')]"
priority=1
weight=100
endpointLocation="East US"
}}
}, { "type": "endpoints", "apiVersion": "2022-04-01", "name": "westus-endpoint",
"dependsOn": [ "[resourceId('Microsoft.Network/trafficManagerProfiles',
parameters('trafficManagerName'))]" ], "properties":
{{scale:multiregion.endpoint
endpointName="westus-endpoint"
type="azureEndpoints"
targetResourceId="[resourceId('Microsoft.Network/publicIPAddresses', 'westus-pip')]"
priority=2
weight=100
endpointLocation="West US"
}}
} ] }
`$3
`handlebars
{ "type": "Microsoft.Network/loadBalancers", "apiVersion": "2023-05-01", "name":
"[parameters('lbName')]", "location": "[parameters('location')]", "sku": {
"name": "Standard", "tier": "Regional" }, "properties":
{{scale:lb.definition
name="[parameters('lbName')]"
sku="Standard"
tier="Regional"
frontendIpName="webFrontend"
publicIpResourceId="[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIpName'))]"
backendPoolName="webBackend"
probeName="httpProbe"
probeProtocol="Http"
probePort=80
probePath="/health"
ruleName="httpRule"
ruleProtocol="Tcp"
ruleFrontendPort=80
ruleBackendPort=80
enableFloatingIp=false
idleTimeoutInMinutes=4
}}
}
`Templates
The plugin generates comprehensive ARM templates for Azure Marketplace offerings:
$3
-
mainTemplate.json - Main VM deployment template
- createUiDefinition.json - Azure Portal UI definition
- viewDefinition.json - Managed application view definition$3
- Core Resources:
-
virtualMachine.json - VM configuration with extensions
- networkInterface.json - Network interface
- publicIpAddress.json - Public IP address
- networkSecurityGroup.json - Security rules- Networking:
-
virtualNetwork.json - VNet and subnets
- loadBalancer.json - Load balancer with health probes
- applicationGateway.json - Application Gateway with WAF
- bastionHost.json - Azure Bastion
- virtualNetworkPeering.json - VNet peering connections- Security:
-
diskEncryption.json - Disk encryption configuration
- trustedLaunch.json - Trusted Launch features
- keyVault.json - Key Vault for secrets and keys- Identity:
-
managedIdentity.json - User-assigned identity resource
- roleAssignment.json - RBAC role assignments$3
The plugin includes 40+ pre-built templates across 8 categories:
1. VM Templates (5 templates): Basic, web server, app server, data server, high-security
2. Networking Templates (12 templates): VNets, subnets, NSGs, load balancers, Application Gateway, Bastion, peering
3. Extension Templates (20 templates): Windows, Linux, and cross-platform extensions
4. Security Templates (12 templates): Encryption types, Trusted Launch, compliance frameworks
5. Identity Templates (12 templates): Managed identity, Azure AD, RBAC
6. Compliance Templates (6 templates): SOC 2, PCI-DSS, HIPAA, ISO 27001, NIST, FedRAMP
7. High Availability Templates (3 templates): Load balanced, availability sets, availability zones
8. Hybrid Templates (5 templates): Combined features for specific scenarios
Plugin Statistics
- Version: 2.1.0 (Latest)
- ARM-TTK Compliance: 98%
- Total Helpers: 170+ Handlebars helpers (14 scaling helpers)
- CLI Commands: 44 commands (12 HA/DR commands)
- Tests: 872 tests (801 passing, 71 skipped)
- Code Coverage: 40% statements, 34% branches, 40% lines
- TypeScript: Full type safety with strict mode
- Documentation: 2,500+ lines of inline documentation
- Marketplace Ready: โ
Certified for Azure Marketplace
Compliance & Security
$3
The plugin provides pre-configured templates for 6 major compliance frameworks:
1. SOC 2 (Service Organization Control 2)
- Encryption at rest and in transit
- Access control and identity management
- Audit logging and monitoring
2. PCI-DSS (Payment Card Industry Data Security Standard)
- Network segmentation
- Strong encryption
- Access control and monitoring
3. HIPAA (Health Insurance Portability and Accountability Act)
- Data encryption and protection
- Access control and audit trails
- Secure authentication
4. ISO 27001 (Information Security Management)
- Risk assessment and management
- Security controls implementation
- Continuous monitoring
5. NIST 800-53 (Security and Privacy Controls)
- Federal security standards
- Comprehensive security controls
- Continuous monitoring
6. FedRAMP (Federal Risk and Authorization Management Program)
- Federal cloud security baseline
- Continuous monitoring and authorization
- Security controls implementation
$3
- Encryption: ADE, SSE with PMK/CMK, Encryption at Host
- Trusted Launch: Secure Boot, vTPM, Boot Integrity Monitoring, Guest Attestation
- Identity: System/User-assigned Managed Identity, Azure AD integration
- Access Control: RBAC with least privilege, Conditional Access, MFA
- Monitoring: Azure Monitor, Diagnostics, Boot Diagnostics, Application Health
Development
$3
- Node.js >= 18.0.0
- TypeScript >= 5.0.0
- Azure Marketplace Generator >= 3.1.0
$3
`bash
Clone the repository
git clone https://github.com/HOME-OFFICE-IMPROVEMENTS-LTD/azmp-plugin-vm.git
cd azmp-plugin-vmInstall dependencies
npm installBuild TypeScript
npm run buildRun tests
npm testRun tests in watch mode
npm run test:watchBuild in watch mode
npm run watchLint code
npm run lintFormat code
npm run format
`$3
`
azmp-plugin-vm/
โโโ src/
โ โโโ index.ts # Main plugin entry point
โ โโโ types.ts # TypeScript interfaces
โ โโโ cli/ # CLI commands
โ โ โโโ index.ts
โ โ โโโ commands/
โ โ โโโ create.ts
โ โ โโโ validate.ts
โ โ โโโ package.ts
โ โโโ core/ # Core VM functionality
โ โ โโโ generator.ts
โ โ โโโ validator.ts
โ โโโ networking/ # Networking modules
โ โ โโโ index.ts
โ โ โโโ vnet.ts
โ โ โโโ subnet.ts
โ โ โโโ nsg.ts
โ โ โโโ loadbalancer.ts
โ โ โโโ applicationgateway.ts
โ โ โโโ bastion.ts
โ โ โโโ peering.ts
โ โโโ extensions/ # VM extensions
โ โ โโโ index.ts
โ โ โโโ windows.ts
โ โ โโโ linux.ts
โ โ โโโ crossplatform.ts
โ โโโ security/ # Security features
โ โ โโโ index.ts
โ โ โโโ encryption.ts
โ โ โโโ trustedlaunch.ts
โ โโโ identity/ # Identity & access
โ โ โโโ index.ts
โ โ โโโ managedidentity.ts
โ โ โโโ azuread.ts
โ โ โโโ rbac.ts
โ โโโ templates/ # Handlebars templates
โ โ โโโ vm/
โ โ โโโ networking/
โ โ โโโ extensions/
โ โ โโโ security/
โ โ โโโ identity/
โ โโโ __tests__/ # Test files
โ โโโ index.test.ts
โ โโโ cli-commands.test.ts
โ โโโ networking.test.ts
โ โโโ extensions.test.ts
โ โโโ identity.test.ts
โโโ docs/ # Documentation
โ โโโ ARCHITECTURE.md
โ โโโ DEVELOPMENT_LOG.md
โ โโโ requirements.md
โ โโโ PHASE*.md
โโโ package.json
โโโ tsconfig.json
โโโ jest.config.js
โโโ .eslintrc.json
โโโ README.md
`$3
The plugin has comprehensive test coverage with 161 tests:
`bash
Run all tests
npm testRun specific test file
npm test -- networking.test.tsRun tests with coverage
npm test -- --coverageRun tests in watch mode
npm run test:watch
`$3
To test the plugin with Azure Marketplace Generator:
1. Build the plugin:
`bash
npm run build
`2. Link locally (in plugin directory):
`bash
npm link
`3. Link in your generator project:
`bash
cd /path/to/your/generator/project
npm link @hoiltd/azmp-plugin-vm
`4. Or use relative path in
azmp-config.json:
`json
{
"plugins": [
{
"package": "../azmp-plugin-vm",
"enabled": true
}
]
}
`$3
We welcome contributions! Please follow these guidelines:
1. Fork the repository
2. Create a feature branch (
git checkout -b feature/amazing-feature)
3. Make your changes with tests
4. Run tests and linting (npm test && npm run lint)
5. Commit your changes (git commit -m 'Add amazing feature')
6. Push to the branch (git push origin feature/amazing-feature)
7. Open a Pull RequestPlease ensure:
- All tests pass
- Code follows the existing style
- Commit messages are clear and descriptive
- Documentation is updated
Changelog
See CHANGELOG.md for detailed release history.
Requirements
- Azure Marketplace Generator: >= 3.1.0
- Node.js: >= 18.0.0
- TypeScript: >= 5.0.0
- Azure Subscription: Required for deployment
Supported Azure Services
- Azure Virtual Machines (Windows & Linux)
- Azure Virtual Networks
- Azure Network Security Groups
- Azure Load Balancer
- Azure Application Gateway
- Azure Bastion
- Azure Key Vault
- Azure Managed Identity
- Azure Active Directory
- Azure Monitor
- Azure Policy
- Azure RBAC
Browser Support
The generated
createUiDefinition.json supports:- Microsoft Edge (latest)
- Google Chrome (latest)
- Mozilla Firefox (latest)
- Apple Safari (latest)
License
MIT License - see LICENSE file for details
Author
HOME OFFICE IMPROVEMENTS LTD
- Website: https://homeofficeimprovements.co.uk
- Email: info@homeofficeimprovements.co.uk
- GitHub: @HOME-OFFICE-IMPROVEMENTS-LTD
Repository
https://github.com/HOME-OFFICE-IMPROVEMENTS-LTD/azmp-plugin-vm
Support
For issues, questions, or contributions:
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Documentation: Wiki
Acknowledgments
- Azure Marketplace team for documentation and support
- TypeScript and Node.js communities
- All contributors to this project
---
Version: 2.1.0
Last Updated: October 31, 2025
Status: โ
Production Ready | โ
Marketplace Certified (98% ARM-TTK)
```