Azure Blob Storage

# Tạo Resource Group
az group create \
  --name rg-az104-m17 \
  --location southeastasia \
  --tags Course=AZ-104 Module=17

# Tên storage account phải unique toàn cầu
STORAGE_NAME="staz104m17$(date +%s | tail -c 6)"
echo "Storage: $STORAGE_NAME"

# Tạo storage account GPv2 Standard LRS
az storage account create \
  --name $STORAGE_NAME \
  --resource-group rg-az104-m17 \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --access-tier Hot \
  --https-only true \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false

# Lấy connection string
CONN_STR=$(az storage account show-connection-string \
  --name $STORAGE_NAME \
  --resource-group rg-az104-m17 \
  --query connectionString -o tsv)

# Tạo container private (mặc định)
az storage container create \
  --name documents \
  --connection-string "$CONN_STR" \
  --public-access off

# Tạo container với blob-level public access (đọc blob nhưng không list)
az storage container create \
  --name public-images \
  --connection-string "$CONN_STR" \
  --public-access blob

# Tạo file test và upload lên container documents
echo "Hello AZ-104 Module 17 - Blob Storage" > /tmp/test-doc.txt
az storage blob upload \
  --container-name documents \
  --name "reports/test-doc.txt" \
  --file /tmp/test-doc.txt \
  --connection-string "$CONN_STR" \
  --tier Hot

# Upload nhiều file từ thư mục (batch)
mkdir -p /tmp/batch-upload
for i in 1 2 3 4 5; do echo "File $i content" > /tmp/batch-upload/file-$i.txt; done
az storage blob upload-batch \
  --destination documents \
  --source /tmp/batch-upload \
  --connection-string "$CONN_STR" \
  --destination-path "batch/"

# Liệt kê blobs trong container
az storage blob list \
  --container-name documents \
  --connection-string "$CONN_STR" \
  --query '[].{Name:name, Tier:properties.blobTier, Size:properties.contentLength}' \
  -o table

# Đổi tier của blob từ Hot sang Cool
az storage blob set-tier \
  --container-name documents \
  --name "reports/test-doc.txt" \
  --tier Cool \
  --connection-string "$CONN_STR"

# Tạo thêm blob và set thẳng lên Archive
echo "Archive content - long term retention" > /tmp/archive-doc.txt
az storage blob upload \
  --container-name documents \
  --name "archive/archive-doc.txt" \
  --file /tmp/archive-doc.txt \
  --connection-string "$CONN_STR" \
  --tier Archive

# Xác nhận tiers
az storage blob list \
  --container-name documents \
  --connection-string "$CONN_STR" \
  --query '[].{Name:name, Tier:properties.blobTier, Status:properties.archiveStatus}' \
  -o table

# --- Demo AzCopy (cần cài sẵn hoặc dùng Cloud Shell có sẵn) ---
# Lấy SAS token để AzCopy xác thực
SAS_TOKEN=$(az storage account generate-sas \
  --account-name $STORAGE_NAME \
  --permissions rwdlacup \
  --resource-types sco \
  --services b \
  --expiry $(date -u -d "2 hours" +%Y-%m-%dT%H:%MZ) \
  --https-only \
  --connection-string "$CONN_STR" \
  -o tsv)

DEST_URL="https://${STORAGE_NAME}.blob.core.windows.net/documents?${SAS_TOKEN}"

# Upload thư mục với AzCopy (nhanh hơn CLI cho dữ liệu lớn)
azcopy copy "/tmp/batch-upload/*" "$DEST_URL" --recursive --put-md5

echo "AzCopy upload hoàn tất"

# Tạo lifecycle policy JSON
cat > /tmp/lifecycle-policy.json << 'EOF'
{
  "rules": [
    {
      "name": "move-old-docs-to-cool",
      "enabled": true,
      "type": "Lifecycle",
      "definition": {
        "filters": {
          "blobTypes": ["blockBlob"],
          "prefixMatch": ["documents/reports/"]
        },
        "actions": {
          "baseBlob": {
            "tierToCool": { "daysAfterModificationGreaterThan": 30 },
            "tierToCold": { "daysAfterModificationGreaterThan": 90 },
            "tierToArchive": { "daysAfterModificationGreaterThan": 365 },
            "delete": { "daysAfterModificationGreaterThan": 2555 }
          },
          "snapshot": {
            "delete": { "daysAfterCreationGreaterThan": 90 }
          }
        }
      }
    },
    {
      "name": "delete-temp-logs",
      "enabled": true,
      "type": "Lifecycle",
      "definition": {
        "filters": {
          "blobTypes": ["blockBlob", "appendBlob"],
          "prefixMatch": ["documents/batch/"]
        },
        "actions": {
          "baseBlob": {
            "delete": { "daysAfterModificationGreaterThan": 30 }
          }
        }
      }
    }
  ]
}
EOF

# Áp dụng lifecycle policy vào storage account
az storage account management-policy create \
  --account-name $STORAGE_NAME \
  --resource-group rg-az104-m17 \
  --policy @/tmp/lifecycle-policy.json

# Xem policy đang có hiệu lực
az storage account management-policy show \
  --account-name $STORAGE_NAME \
  --resource-group rg-az104-m17 \
  --query 'policy.rules[].{Name:name, Enabled:enabled}' \
  -o table

# Tạo destination storage account (có thể khác region để test cross-region replication)
STORAGE_DEST="staz104m17dst$(date +%s | tail -c 4)"
az storage account create \
  --name $STORAGE_DEST \
  --resource-group rg-az104-m17 \
  --location eastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --https-only true \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false

CONN_DEST=$(az storage account show-connection-string \
  --name $STORAGE_DEST \
  --resource-group rg-az104-m17 \
  --query connectionString -o tsv)

# Bật versioning trên source (bắt buộc cho object replication)
az storage account blob-service-properties update \
  --account-name $STORAGE_NAME \
  --resource-group rg-az104-m17 \
  --enable-versioning true \
  --enable-change-feed true

# Bật versioning trên destination (bắt buộc)
az storage account blob-service-properties update \
  --account-name $STORAGE_DEST \
  --resource-group rg-az104-m17 \
  --enable-versioning true

# Tạo container destination
az storage container create \
  --name documents-replica \
  --connection-string "$CONN_DEST" \
  --public-access off

# Tạo Object Replication Policy: source documents → dest documents-replica
az storage account or-policy create \
  --account-name $STORAGE_DEST \
  --resource-group rg-az104-m17 \
  --source-account $STORAGE_NAME \
  --destination-account $STORAGE_DEST \
  --source-container documents \
  --destination-container documents-replica \
  --min-creation-time "2026-01-01T00:00:00Z"

# Lấy Policy ID vừa tạo
POLICY_ID=$(az storage account or-policy list \
  --account-name $STORAGE_DEST \
  --resource-group rg-az104-m17 \
  --query '[0].policyId' -o tsv)
echo "Replication Policy ID: $POLICY_ID"

# Áp policy lên source account
az storage account or-policy show \
  --account-name $STORAGE_DEST \
  --resource-group rg-az104-m17 \
  --policy-id $POLICY_ID -o json | \
az storage account or-policy create \
  --account-name $STORAGE_NAME \
  --resource-group rg-az104-m17 \
  --policy @-

# Xóa toàn bộ Resource Group (bao gồm cả 2 storage accounts)
az group delete --name rg-az104-m17 --yes --no-wait

echo "Resource Group rg-az104-m17 đang được xóa nền. Bao gồm: $STORAGE_NAME, $STORAGE_DEST."