Azure Storage — Blob & Files

# Tạo Resource Group
az group create \
  --name rg-hoatranlab-lab04 \
  --location southeastasia

# Tạo Storage Account với bảo mật chuẩn 2026
# Đặt suffix ngẫu nhiên để tránh name conflict
SUFFIX=$RANDOM
SA_NAME="sthoatranlab${SUFFIX}"

az storage account create \
  --name $SA_NAME \
  --resource-group rg-hoatranlab-lab04 \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --min-tls-version TLS1_2 \
  --https-only true \
  --allow-blob-public-access false \
  --tags env=lab module=az104

echo "Storage Account: $SA_NAME"

# Lấy connection string (dùng cho AzCopy và CLI)
az storage account show-connection-string \
  --name $SA_NAME \
  --resource-group rg-hoatranlab-lab04 \
  --output tsv

# Lấy storage key để auth CLI
SA_KEY=$(az storage account keys list \
  --account-name $SA_NAME \
  --resource-group rg-hoatranlab-lab04 \
  --query "[0].value" -o tsv)

# Tạo 3 containers
for CONTAINER in assets reports backup; do
  az storage container create \
    --name $CONTAINER \
    --account-name $SA_NAME \
    --account-key $SA_KEY \
    --public-access off
done

# Tạo file test để upload
echo "HoaTranLab Azure Storage Lab 04" > testfile.txt
date >> testfile.txt

# Upload file vào container assets (Hot tier mặc định)
az storage blob upload \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --container-name assets \
  --name "docs/testfile.txt" \
  --file testfile.txt \
  --tier Hot

# Upload file vào reports (Cool tier)
az storage blob upload \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --container-name reports \
  --name "2026/report-q1.txt" \
  --file testfile.txt \
  --tier Cool

# Liệt kê blobs trong container assets
az storage blob list \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --container-name assets \
  --output table

# Tính thời gian hết hạn: 2 giờ từ hiện tại
END_TIME=$(date -u -d '+2 hours' '+%Y-%m-%dT%H:%MZ' 2>/dev/null \
  || date -u -v+2H '+%Y-%m-%dT%H:%MZ')

# Tạo SAS token cho 1 blob cụ thể (Read only, HTTPS)
SAS_TOKEN=$(az storage blob generate-sas \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --container-name assets \
  --name "docs/testfile.txt" \
  --permissions r \
  --expiry $END_TIME \
  --https-only \
  --output tsv)

# Tạo full URL để chia sẻ
BLOB_URL="https://${SA_NAME}.blob.core.windows.net/assets/docs/testfile.txt?${SAS_TOKEN}"
echo "SAS URL (valid 2 hours):"
echo $BLOB_URL

# Test download qua curl (không cần auth)
curl -s "$BLOB_URL"

# Tạo Account-level SAS (toàn storage account)
az storage account generate-sas \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --resource-types sco \
  --services bfqt \
  --permissions rl \
  --expiry $END_TIME \
  --https-only \
  --output tsv

# Tạo Azure File share
az storage share create \
  --name share-team \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --quota 100

# Upload file vào file share
az storage file upload \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --share-name share-team \
  --source testfile.txt \
  --path "shared/testfile.txt"

# Liệt kê files trong share
az storage file list \
  --account-name $SA_NAME \
  --account-key $SA_KEY \
  --share-name share-team \
  --output table

# Đăng nhập AzCopy bằng Microsoft Entra ID
azcopy login

# Tạo thư mục test với nhiều files
mkdir azcopy-test
for i in 1 2 3 4 5; do
  echo "File $i - $(date)" > azcopy-test/file${i}.txt
done

# Upload cả thư mục lên container (recursive)
azcopy copy \
  "azcopy-test/*" \
  "https://${SA_NAME}.blob.core.windows.net/assets/" \
  --recursive

# Xem kết quả upload
azcopy list \
  "https://${SA_NAME}.blob.core.windows.net/assets/"

# Copy giữa 2 containers trong cùng storage account
azcopy copy \
  "https://${SA_NAME}.blob.core.windows.net/assets/" \
  "https://${SA_NAME}.blob.core.windows.net/backup/" \
  --recursive

# Download container về local
azcopy copy \
  "https://${SA_NAME}.blob.core.windows.net/assets/" \
  "./download-test/" \
  --recursive

# Tạo lifecycle policy (JSON inline)
az storage account management-policy create \
  --account-name $SA_NAME \
  --resource-group rg-hoatranlab-lab04 \
  --policy '{
    "rules": [{
      "name": "tier-down-old-blobs",
      "enabled": true,
      "type": "Lifecycle",
      "definition": {
        "filters": {
          "blobTypes": ["blockBlob"]
        },
        "actions": {
          "baseBlob": {
            "tierToCool": {
              "daysAfterModificationGreaterThan": 30
            },
            "tierToArchive": {
              "daysAfterModificationGreaterThan": 90
            },
            "delete": {
              "daysAfterModificationGreaterThan": 365
            }
          }
        }
      }
    }]
  }'

# Verify policy
az storage account management-policy show \
  --account-name $SA_NAME \
  --resource-group rg-hoatranlab-lab04