Getting Started

Install Prerequisites

Install-Module -Name Az -Scope CurrentUser -Force
Install-Module -Name powershell-yaml -Scope CurrentUser -Force

Use PowerShell 7 or newer.

Import the module from the repository root:

Import-Module .\AzureSqlVmToolkit.psd1 -Force

Prepare Local Config

Copy-Item .\config.yaml .\config.local.yaml

Edit config.local.yaml and replace placeholder values for resource group, Key Vault, storage account, storage resource group, file share, and VM admin username.

The repository ignores config.local.yaml and *.local.yaml.

Validate the config without Azure calls:

Test-AzureSqlVmToolkitConfig -ConfigFile .\config.local.yaml

Preview

New-AzureSqlVmToolkitDeployment -ConfigFile .\config.local.yaml -SecurityAssessmentAdvice -Plan

-Plan does not call Azure. It validates the YAML and prints intended resource names and safety posture.

Deploy

With an existing Key Vault password secret:

Connect-AzAccount
New-AzureSqlVmToolkitDeployment -ConfigFile .\config.local.yaml -SecurityAssessmentAdvice

For a disposable lab where the password secret does not exist yet:

New-AzureSqlVmToolkitDeployment -ConfigFile .\config.local.yaml -SecurityAssessmentAdvice -GeneratePassword

Only add -ShowPassword when printing the password to the console is acceptable.

After Deployment

Use Azure Bastion to connect to the VM. The VM has no public IP by default.

To restore .bak files, put them on the mounted Azure Files share and run the uploaded helper inside the VM:

Z:\restore-databases.ps1

The helper uses dbatools and -WithReplace, so review the files before running it.

Local Checks

.\scripts\Test-Local.ps1 -ConfigFile .\config.local.yaml

This runs parser checks, module manifest validation, schema parsing, config validation through -Plan, Pester tests when installed, and PSScriptAnalyzer when installed.