Cấu hình Azure Policy

# Lấy Tenant ID và Subscription ID
TENANT_ID=$(az account show --query tenantId -o tsv)
SUB_ID=$(az account show --query id -o tsv)
echo "Tenant: $TENANT_ID | Sub: $SUB_ID"

# Tạo Management Group "HoaTranLab-NonProd"
az account management-group create \
  --name "HoaTranLab-NonProd" \
  --display-name "HoaTranLab NonProd"

# Di chuyển subscription hiện tại vào Management Group
az account management-group subscription add \
  --name "HoaTranLab-NonProd" \
  --subscription $SUB_ID

# Tạo Resource Group cho lab
az group create \
  --name rg-az104-m04 \
  --location southeastasia \
  --tags Course=AZ-104 Module=04 Environment=Lab

SUB_ID=$(az account show --query id -o tsv)

# Tạo policy rule JSON
cat > /tmp/require-costcenter-tag.json << 'EOF'
{
  "if": {
    "allOf": [
      {
        "field": "type",
        "notEquals": "Microsoft.Resources/resourceGroups"
      },
      {
        "field": "tags['CostCenter']",
        "exists": "false"
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}
EOF

# Tạo policy definition ở subscription scope
az policy definition create \
  --name "require-costcenter-tag" \
  --display-name "Yêu cầu tag CostCenter trên mọi resource" \
  --description "Từ chối tạo resource nếu không có tag CostCenter" \
  --rules /tmp/require-costcenter-tag.json \
  --mode All \
  --subscription $SUB_ID

echo "Policy definition created: require-costcenter-tag"

SUB_ID=$(az account show --query id -o tsv)

# Lấy ID của custom policy definition vừa tạo
POLICY_ID=$(az policy definition show \
  --name "require-costcenter-tag" \
  --query id -o tsv)

echo "Policy ID: $POLICY_ID"

# Tạo initiative definition JSON
cat > /tmp/hoatranlab-governance-initiative.json << EOF
[
  {
    "policyDefinitionId": "$POLICY_ID",
    "policyDefinitionReferenceId": "requireCostCenterTag"
  },
  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a",
    "policyDefinitionReferenceId": "auditVMWithoutManagedDisk"
  }
]
EOF

# Tạo initiative definition
az policy set-definition create \
  --name "hoatranlab-governance" \
  --display-name "HoaTranLab Governance Initiative" \
  --description "Nhóm policy quản trị cơ bản cho HoaTranLab" \
  --definitions /tmp/hoatranlab-governance-initiative.json \
  --subscription $SUB_ID

# Assign initiative lên Resource Group
az policy assignment create \
  --name "governance-rg-m04" \
  --display-name "HoaTranLab Governance — rg-az104-m04" \
  --policy-set-definition "hoatranlab-governance" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m04"

echo "Initiative assigned to rg-az104-m04"

SUB_ID=$(az account show --query id -o tsv)

# Thử tạo storage account KHÔNG có tag CostCenter — kỳ vọng bị DENY
az storage account create \
  --name "stm04nodeny$(date +%s | tail -c 5)" \
  --resource-group rg-az104-m04 \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2
# Kỳ vọng: RequestDisallowedByPolicy error

# Tạo storage account CÓ tag CostCenter — kỳ vọng thành công
az storage account create \
  --name "stm04ok$(date +%s | tail -c 5)" \
  --resource-group rg-az104-m04 \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --tags CostCenter=IT-001 Course=AZ-104 Module=04

# Trigger policy compliance scan thủ công
az policy state trigger-scan \
  --resource-group rg-az104-m04

# Xem compliance summary
az policy state summarize \
  --resource-group rg-az104-m04 \
  --query "value[0].results" -o json

SUB_ID=$(az account show --query id -o tsv)

# Xóa policy assignment trước
az policy assignment delete \
  --name "governance-rg-m04" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m04"

# Xóa initiative definition
az policy set-definition delete \
  --name "hoatranlab-governance" \
  --subscription $SUB_ID

# Xóa custom policy definition
az policy definition delete \
  --name "require-costcenter-tag" \
  --subscription $SUB_ID

# Gỡ subscription khỏi Management Group
az account management-group subscription remove \
  --name "HoaTranLab-NonProd" \
  --subscription $SUB_ID

# Xóa Management Group
az account management-group delete \
  --name "HoaTranLab-NonProd"

# Xóa Resource Group (xóa toàn bộ resource bên trong)
az group delete --name rg-az104-m04 --yes --no-wait