ARM Templates & Bicep

# Tạo Resource Group
az group create --name rg-az104-m08 --location southeastasia

# Tạo file ARM template JSON — deploy Storage Account + VNet
cat > /tmp/azuredeploy.json << 'ARMEOF'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "minLength": 3,
      "maxLength": 24,
      "metadata": { "description": "Tên Storage Account duy nhất toàn cầu" }
    },
    "vnetName": {
      "type": "string",
      "defaultValue": "vnet-m08-lab",
      "metadata": { "description": "Tên Virtual Network" }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]"
    },
    "environment": {
      "type": "string",
      "defaultValue": "Lab",
      "allowedValues": ["Lab","Dev","Prod"]
    }
  },
  "variables": {
    "subnetName": "subnet-default",
    "vnetAddressPrefix": "10.8.0.0/16",
    "subnetAddressPrefix": "10.8.0.0/24"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-01-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": { "name": "Standard_LRS" },
      "kind": "StorageV2",
      "properties": {
        "accessTier": "Hot",
        "supportsHttpsTrafficOnly": true,
        "minimumTlsVersion": "TLS1_2"
      },
      "tags": {
        "Environment": "[parameters('environment')]",
        "Module": "08",
        "DeployedBy": "ARM-Template"
      }
    },
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2023-09-01",
      "name": "[parameters('vnetName')]",
      "location": "[parameters('location')]",
      "properties": {
        "addressSpace": { "addressPrefixes": ["[variables('vnetAddressPrefix')]"] },
        "subnets": [
          {
            "name": "[variables('subnetName')]",
            "properties": { "addressPrefix": "[variables('subnetAddressPrefix')]" }
          }
        ]
      },
      "tags": {
        "Environment": "[parameters('environment')]",
        "Module": "08"
      }
    }
  ],
  "outputs": {
    "storageAccountId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
    },
    "vnetId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]"
    }
  }
}
ARMEOF

# Tạo file parameters
STORAGE_UNIQUE="stm08arm$(date +%s | tail -c 6)"
cat > /tmp/azuredeploy.parameters.json << EOF
{
  "\$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": { "value": "$STORAGE_UNIQUE" },
    "vnetName":           { "value": "vnet-m08-lab" },
    "environment":        { "value": "Lab" }
  }
}
EOF

echo "Storage name sẽ deploy: $STORAGE_UNIQUE"

# Validate template trước khi deploy
az deployment group validate \
  --resource-group rg-az104-m08 \
  --template-file /tmp/azuredeploy.json \
  --parameters @/tmp/azuredeploy.parameters.json

echo "Validation passed. Tiến hành deploy..."

# Deploy ARM template
az deployment group create \
  --resource-group rg-az104-m08 \
  --name "Deploy-ARM-M08-$(date +%Y%m%d%H%M)" \
  --template-file /tmp/azuredeploy.json \
  --parameters @/tmp/azuredeploy.parameters.json \
  --mode Incremental

echo "Deploy completed!"

# Deploy lần 2: đổi environment thành Dev — kiểm tra Incremental idempotent
STORAGE_UNIQUE=$(az storage account list -g rg-az104-m08 --query "[0].name" -o tsv)

cat > /tmp/azuredeploy.parameters.dev.json << EOF
{
  "\$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": { "value": "$STORAGE_UNIQUE" },
    "vnetName":           { "value": "vnet-m08-lab" },
    "environment":        { "value": "Dev" }
  }
}
EOF

# Deploy lại cùng template, parameters khác — chỉ update tag, không tạo lại resource
az deployment group create \
  --resource-group rg-az104-m08 \
  --name "Deploy-ARM-M08-Dev-$(date +%Y%m%d%H%M)" \
  --template-file /tmp/azuredeploy.json \
  --parameters @/tmp/azuredeploy.parameters.dev.json \
  --mode Incremental

# Kiểm tra tag đã đổi chưa
az storage account show \
  --name $STORAGE_UNIQUE \
  --resource-group rg-az104-m08 \
  --query "tags" \
  --output table

# Xem deployment history
az deployment group list \
  --resource-group rg-az104-m08 \
  --query "[].{Name:name,State:properties.provisioningState,Time:properties.timestamp}" \
  --output table

# Cài Bicep CLI (nếu chưa có — trong Cloud Shell đã có sẵn)
az bicep install

# Tạo file Bicep — deploy Storage Account với lifecycle management policy
BICEP_STORAGE="stm08bicep$(date +%s | tail -c 6)"

cat > /tmp/main.bicep << 'BICEPEOF'
@description('Tên Storage Account — unique toàn cầu')
@minLength(3)
@maxLength(24)
param storageAccountName string

@description('Region deploy')
param location string = resourceGroup().location

@description('SKU replication')
@allowed(['Standard_LRS', 'Standard_GRS', 'Standard_ZRS'])
param storageSku string = 'Standard_LRS'

@description('Environment tag')
param environment string = 'Lab'

// Storage Account resource
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: storageSku
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
  }
  tags: {
    Environment: environment
    Module: '08'
    DeployedBy: 'Bicep'
  }
}

// Blob service — bật versioning
resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    isVersioningEnabled: true
    deleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}

// Output
output storageAccountId string = storageAccount.id
output blobEndpoint string = storageAccount.properties.primaryEndpoints.blob
BICEPEOF

echo "Bicep file created. Preview ARM JSON output:"

# Build Bicep → ARM JSON để xem trước (không deploy)
az bicep build --file /tmp/main.bicep --outfile /tmp/main.generated.json
echo "Generated ARM JSON lines: $(wc -l < /tmp/main.generated.json)"

# Deploy Bicep trực tiếp (Azure CLI tự biên dịch sang ARM JSON)
az deployment group create \
  --resource-group rg-az104-m08 \
  --name "Deploy-Bicep-M08-$(date +%Y%m%d%H%M)" \
  --template-file /tmp/main.bicep \
  --parameters storageAccountName="$BICEP_STORAGE" environment="Lab" \
  --mode Incremental

echo "Bicep deploy completed: $BICEP_STORAGE"

# Xác nhận resource
az storage account show \
  --name $BICEP_STORAGE \
  --resource-group rg-az104-m08 \
  --query "{name:name,sku:sku.name,isVersioningEnabled:properties.isVersioningEnabled}" \
  --output table 2>/dev/null || \
az storage account show \
  --name $BICEP_STORAGE \
  --resource-group rg-az104-m08 \
  --query "{name:name,sku:sku.name}" \
  --output table

# Xem deployment history của RG
az deployment group list \
  --resource-group rg-az104-m08 \
  --query "[].{Name:name,State:properties.provisioningState,Timestamp:properties.timestamp,Mode:properties.mode}" \
  --output table

# Xem chi tiết một deployment cụ thể (thay tên deployment thực tế)
DEPLOY_NAME=$(az deployment group list -g rg-az104-m08 --query "[0].name" -o tsv)
az deployment group show \
  --resource-group rg-az104-m08 \
  --name $DEPLOY_NAME \
  --query "{name:name,state:properties.provisioningState,outputs:properties.outputs}" \
  --output json

# Export ARM template từ RG hiện tại (reverse engineer hạ tầng đang chạy)
az group export --name rg-az104-m08 --output json > /tmp/exported-template.json
echo "Exported template size: $(wc -l < /tmp/exported-template.json) dòng"
echo "Xem resource types trong export:"
cat /tmp/exported-template.json | python3 -c "
import sys, json
t = json.load(sys.stdin)
for r in t.get('resources', []):
    print(f\"  {r.get('type')} / {r.get('name')}\")"

# Xóa Resource Group — kéo theo toàn bộ resource (Storage, VNet, Blob service)
az group delete --name rg-az104-m08 --yes --no-wait

echo "Cleanup initiated. Xác nhận sau vài phút:"
az group list --query "[?name=='rg-az104-m08']" --output table

# Dọn file tạm
rm -f /tmp/azuredeploy.json /tmp/azuredeploy.parameters*.json
rm -f /tmp/main.bicep /tmp/main.generated.json /tmp/exported-template.json
echo "Temp files cleaned."