Which vCenter Key Provider (KMS or Native Key Provider) Is a VM Using? Find It for vTPM and Encrypted VMs

Short answer: Every encrypted VM, including a VM that only has a vTPM, stores a reference to its key in the vSphere API property config.keyId. The providerId.id field in that property is the key provider’s name. That provider can be a Standard Key Provider (external KMS), a Trusted Key Provider or the vSphere Native Key Provider. Read it with PowerCLI through ExtensionData.Config.KeyId. The vSphere Client doesn’t show it for VMs that use vTPM only.

Why the question comes up

vCenter needs a key provider for VM Encryption, vTPM and vSAN encryption. There are three types (Key Providers):

Many environments start with the Native Key Provider for vTPM and add an external KMS later, or run two KMS clusters during a migration. Which provider to choose, how to set up and back up a Native Key Provider, and how to add a vTPM are covered in vSphere key providers and vTPM: Native Key Provider vs external KMS. Before you retire a provider, you need to know which VMs still depend on it. Otherwise those VMs won’t power on or unlock after the provider is gone.

Where the key provider is recorded

• VM home (VMX, NVRAM): VirtualMachineConfigInfo.keyId, a CryptoKeyId with keyId (the key ID) and providerId.id (the provider). See the VirtualMachineConfigInfo and CryptoKeyId API references.
• Each encrypted disk: backing.keyId on the virtual disk (VirtualDiskFlatVer2BackingInfo). A disk can use a different key from the VM home.

A vTPM VM has a key ID too. The vTPM keeps its state in the .nvram file, and VM Encryption encrypts the VM home files for it. The disks stay unencrypted unless you encrypt them yourself (What Is a Virtual Trusted Platform Module). So config.keyId is set, even though the VM doesn’t look encrypted in the UI.

PowerCLI: list VMs by key provider

Connect-VIServer vcenter.example.com

Get-VM | Where-Object { $_.ExtensionData.Config.KeyId } |
  Select-Object Name,
    @{N='KeyProvider';E={ $_.ExtensionData.Config.KeyId.ProviderId.Id }},
    @{N='KeyId';E={ $_.ExtensionData.Config.KeyId.KeyId }},
    @{N='vTPM';E={ [bool]($_.ExtensionData.Config.Hardware.Device |
        Where-Object { $_ -is [VMware.Vim.VirtualTPM] }) }} |
  Sort-Object KeyProvider, Name

To see the provider for each disk:

Get-VM 'app01' | Get-HardDisk |
  Select-Object Name,
    @{N='KeyProvider';E={ $_.ExtensionData.Backing.KeyId.ProviderId.Id }}

Compare the KeyProvider values with the list under vCenter > Configure > Security > Key Providers. If a VM points to a provider name that no longer exists there, that VM is at risk.

What the vSphere Client shows

For VMs with encrypted disks, the vSphere Client shows encryption details on the VM. For a VM with only a vTPM, the Encryption section doesn’t say which key provider holds the key. That’s why the API query above is the reliable way to audit a vCenter.

Moving VMs to another key provider

vSphere supports rekeying an encrypted VM with the same key provider or with a different one. A shallow rekey replaces only the Key Encryption Key and can run while the VM is powered on, unless the VM has IDE controllers. A deep rekey also replaces the Disk Encryption Key and needs the VM powered off (Rekey an Encrypted Virtual Machine). Plan the move as follows:

1. Run the inventory above and export it (Export-Csv).
2. Make sure the new provider is configured and healthy on all hosts. If it is a Native Key Provider, back it up. vCenter raises an alarm while an NKP isn’t backed up.
3. Rekey the VMs (and their encrypted disks) to the new provider.
4. Run the inventory again. Remove the old provider only when no VM or disk refers to it.

Related on vDan: ESXi host certificate status alert and vSphere 9.0 product line comparison.

Further reading

• William Lam: Quick Tip – Which vCenter Server Key Provider (KMS) is a VM using? (the original post, with his vm-to-kms-association.ps1 script)
• Broadcom TechDocs: vSphere Native Key Provider Overview
• Broadcom TechDocs: Comparison of vSphere Key Providers