Optimized creation of identity information for provisioned virtual machines

1 . A method of initializing a virtual machine (VM) image, comprising:

retrieving identity data from a metadata service implemented by a cloud environment;

obtaining, from the cloud environment, a virtual identity disk assigned to a VM;

writing the identity data to the virtual identity disk assigned to the VM:

encrypting the identity data comprises encrypting the identity data with a data encryption key (DEK);

creating the DEK;

storing a first copy of the DEK in a registry entry of the VM image;

storing, within a location accessible by a delivery controller, a second copy of the DEK in association with the VM image, wherein encrypting the identity data with the DEK comprises encrypting, by the delivery controller, the identity data using the second copy of the DEK:

storing, by the delivery controller, the encrypted identity data in the metadata service;

obtaining, by the VM during a boot, the first copy of the DEK from the registry entry, wherein retrieving the identity data from the metadata service comprises retrieving, by the VM, the encrypted identity data from the metadata service; and

decrypting, by the VM and during the boot, the encrypted identity data, wherein writing the identity data to the virtual identity disk comprises writing the decrypted identity data to the virtual identity disk.

2 . The method of claim 1 , wherein encrypting the identity data comprises encrypting the identity data using a public key of a virtual trusted platform module (vTPM).

3 . The method of claim 2 , wherein:

encrypting the identity data using the public key of the vTPM comprises encrypting, by a delivery controller, the identity data using the public key of the vTPM; and

further comprising:

enrolling, by the delivery controller and with the cloud environment, the vTPM for the VM;

obtaining, by the delivery controller and from the cloud environment, the public key of the vTPM;

storing, by the delivery controller, the encrypted identity data in the metadata service for the VM; and

responsive to the virtual identity disk being empty during a boot of the VM, instructing, by the VM, the vTPM to decrypt the data.

4 . The method of claim 2 , wherein encrypting the identity data using the vTPM comprises checking for availability of the vTPM, and responsive to the vTPM being available, using the vTPM.

5 . The method of claim 1 , wherein the identity data comprises a password associated with an account of the VM and/or a unique hostname of the VM.

6 . The method of claim 1 , further comprising:

creating the virtual identity disk;

confirming that the virtual identity disk is empty; and

formatting the virtual identity disk.

7 . The method of claim 1 , further comprising transmitting the identity data to the metadata service.

8 . The method of claim 1 , further comprising instructing a directory service to change a password associated with an account of the VM.

9 . A computer system configured to initialize a virtual machine (VM) image, the computer system comprising:

a memory; and

at least one processor coupled to the memory and configured to obtain, from a cloud environment, a virtual identity disk assigned to a VM, wherein the VM is configured to:

retrieve identity data from a metadata service implemented by the cloud environment; and

write the identity data to the virtual identity disk assigned to the VM;

wherein the at least one processor is further configured to:

encrypt the identity data with a data encryption key (DEK);

create the DEK;

store a first copy of the DEK in a registry entry of the VM image;

store, within an accessible location, a second copy of the DEK in association with the VM image, wherein to encrypt the identity data with the DEK comprises to encrypt the identity data using the second copy of the DEK: and store the encrypted identity data in the metadata service; and

wherein the VM is configured, during a boot, to:

obtain the first copy of the DEK from the registry entry; and

decrypt the encrypted identity data, wherein to write the identity data to the virtual identity disk comprises to write the decrypted identity data to the virtual identity disk.

10 . The computer system of claim 9 , wherein the at least one processor is further configured to encrypt the identity data using a public key of a virtual trusted platform module (vTPM).

11 . The computer system of claim 10 :

wherein the at least one processor is further configured to:

enroll the vTPM for the VM with the cloud environment;

obtain, from the cloud environment, the public key of the vTPM; and

store the encrypted identity data in the metadata service for the VM; and

wherein the VM is further configured to:

retrieve the encrypted identity data from the metadata service; and

responsive to the virtual identity disk being empty during a boot, instruct the vTPM to decrypt the data.

12 . The computer system of claim 9 , wherein:

the at least one processor is further configured to create the virtual identity disk; and

the VM is further configured to:

confirm that the virtual identity disk is empty; and

format the virtual identity disk.

13 . A non-transitory computer readable medium storing executable sequences of instructions to initialize a virtual machine (VM) image, the sequences of instructions comprising instructions to:

retrieve identity data from a metadata service implemented by a cloud environment; and

write the identity data to a virtual identity disk assigned to a VM, wherein a delivery controller is configured to obtain, from the cloud environment, the virtual identity disk assigned to the VM;

wherein the sequences of instructions further comprise instructions to:

encrypt the identity data with a data encryption key (DEK);

create the DEK:

store a first copy of the DEK in a registry entry of the VM image;

store, within an accessible location, a second copy of the DEK in association with the VM image, wherein to encrypt the identity data with the DEK comprises to encrypt the identity data using the second copy of the DEK: and

store the encrypted identity data in the metadata service; and

wherein the VM is configured, during a boot, to:

obtain the first copy of the DEK from the registry entry; and

decrypt the encrypted identity data, wherein to write the identity data to the virtual identity disk comprises to write the decrypted identity data to the virtual identity disk.

14 . The non-transitory computer readable medium of claim 13 , wherein:

the data encryption key (DEK) is from a virtual trusted platform module (vTPM).

15 . The non-transitory computer readable medium of claim 13 , wherein the identity data comprises a password associated with an account of the VM and/or a unique hostname of the VM.