Cấu Hình Service Endpoint cho Storage Account

1. Portal → Resource groups → + Create
   - Name: rg-az500-ch07-private
   - Region: Southeast Asia
   - Tags: course=az500, chapter=ch07

2. Portal → Virtual networks → + Create
   - Name: vnet-az500-private
   - Resource group: rg-az500-ch07-private
   - Region: Southeast Asia
   - IPv4 address space: 10.10.0.0/16

3. Tab "Subnets" → Add subnet:
   Subnet 1:
   - Name: snet-app
   - Address range: 10.10.1.0/24
   - Services (Service Endpoint): Microsoft.Storage ← BẬT TẠI ĐÂY
   Subnet 2:
   - Name: snet-test
   - Address range: 10.10.2.0/24
   - Services: (để trống — không có Service Endpoint)

4. Review + Create → Create

# Tạo resource group
az group create \
  --name rg-az500-ch07-private \
  --location southeastasia \
  --tags "course=az500" "chapter=ch07" "owner=hoatranlab"

# Tạo VNet
az network vnet create \
  --name vnet-az500-private \
  --resource-group rg-az500-ch07-private \
  --location southeastasia \
  --address-prefix 10.10.0.0/16

# Tạo snet-app với Service Endpoint Microsoft.Storage
az network vnet subnet create \
  --name snet-app \
  --vnet-name vnet-az500-private \
  --resource-group rg-az500-ch07-private \
  --address-prefix 10.10.1.0/24 \
  --service-endpoints Microsoft.Storage

# Tạo snet-test không có Service Endpoint
az network vnet subnet create \
  --name snet-test \
  --vnet-name vnet-az500-private \
  --resource-group rg-az500-ch07-private \
  --address-prefix 10.10.2.0/24

# Xác nhận subnet và service endpoint
az network vnet subnet show \
  --name snet-app \
  --vnet-name vnet-az500-private \
  --resource-group rg-az500-ch07-private \
  --query "serviceEndpoints"

[
  {
    "locations": ["southeastasia"],
    "provisioningState": "Succeeded",
    "service": "Microsoft.Storage"
  }
]

1. Portal → Storage accounts → + Create
   Basics:
   - Resource group: rg-az500-ch07-private
   - Storage account name: staz500lab28[4-ký-tự-random] (ví dụ: staz500lab28xk9m)
   - Region: Southeast Asia
   - Performance: Standard
   - Redundancy: LRS

   Advanced:
   - Minimum TLS version: TLS 1.2 ← BẮT BUỘC
   - Allow Blob anonymous access: DISABLED ← BẮT BUỘC

   Networking:
   - Network access: "Enable from selected virtual networks and IP addresses"
   - Virtual networks → + Add existing virtual network:
     VNet: vnet-az500-private
     Subnet: snet-app ← CHỈ subnet này

2. Review + Create → Create

# Lấy subnet ID
SUBNET_ID=$(az network vnet subnet show \
  --name snet-app \
  --vnet-name vnet-az500-private \
  --resource-group rg-az500-ch07-private \
  --query id -o tsv)

# Tạo Storage Account với network rule
az storage account create \
  --name staz500lab28xk9m \
  --resource-group rg-az500-ch07-private \
  --location southeastasia \
  --sku Standard_LRS \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --default-action Deny \
  --bypass AzureServices

# Thêm subnet rule cho snet-app
az storage account network-rule add \
  --account-name staz500lab28xk9m \
  --resource-group rg-az500-ch07-private \
  --subnet $SUBNET_ID

# Xác nhận network rules
az storage account show \
  --name staz500lab28xk9m \
  --resource-group rg-az500-ch07-private \
  --query "networkRuleSet" \
  --output json

{
  "bypass": "AzureServices",
  "defaultAction": "Deny",
  "ipRules": [],
  "virtualNetworkRules": [
    {
      "action": "Allow",
      "state": "Succeeded",
      "virtualNetworkResourceId": "/subscriptions/.../snet-app"
    }
  ]
}

# VM trong snet-app (có Service Endpoint — được phép truy cập storage)
az vm create \
  --resource-group rg-az500-ch07-private \
  --name vm-app \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --vnet-name vnet-az500-private \
  --subnet snet-app \
  --public-ip-sku Standard \
  --admin-username azureuser \
  --generate-ssh-keys \
  --no-wait

# VM trong snet-test (KHÔNG có Service Endpoint — bị từ chối)
az vm create \
  --resource-group rg-az500-ch07-private \
  --name vm-test \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --vnet-name vnet-az500-private \
  --subnet snet-test \
  --public-ip-sku Standard \
  --admin-username azureuser \
  --generate-ssh-keys

1. Storage account → Containers → + Container
   - Name: lab28-container
   - Public access: Private

2. Vào container → Upload → chọn file bất kỳ (vd: test.txt)

3. Ghi lại URL: https://staz500lab28xk9m.blob.core.windows.net/lab28-container/test.txt

# Lấy connection string (chạy từ máy local hoặc Cloud Shell)
CONN=$(az storage account show-connection-string \
  --name staz500lab28xk9m \
  --resource-group rg-az500-ch07-private \
  --query connectionString -o tsv)

# Tạo container
az storage container create \
  --name lab28-container \
  --connection-string "$CONN" \
  --public-access off

# Upload file test
echo "Hello from AZ-500 Lab 28" > /tmp/test.txt
az storage blob upload \
  --container-name lab28-container \
  --name test.txt \
  --file /tmp/test.txt \
  --connection-string "$CONN"

# SSH vào vm-app
ssh azureuser@<public-ip-vm-app>

# Cài azure-cli trên Ubuntu
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Đăng nhập (dùng device code)
az login --use-device-code

# List blob từ snet-app — KẾT QUẢ: thành công
az storage blob list \
  --account-name staz500lab28xk9m \
  --container-name lab28-container \
  --output table \
  --auth-mode login

# SSH vào vm-test
ssh azureuser@<public-ip-vm-test>

# Thử truy cập blob — KẾT QUẢ: 403 AuthorizationFailure
curl -I https://staz500lab28xk9m.blob.core.windows.net/lab28-container/test.txt
# HTTP/1.1 403 This request is not authorized to perform this operation.

# Nguyên nhân: snet-test không có Service Endpoint,
# request đi qua public internet → bị Deny theo default-action