Key Vault — Secret, Key & Certificate

# Tạo resource group
az group create --name rg-az500-lab40 --location southeastasia

# Key Vault name phải globally unique
KV_NAME="kv-az500-lab40-$(shuf -i 100-999 -n 1)"
echo "Key Vault: $KV_NAME"

# Tạo Key Vault:
# --enable-rbac-authorization true = dùng RBAC thay vault access policy
# --enable-soft-delete true + --soft-delete-retention-days 90
# --enable-purge-protection true = không ai có thể purge vault trong retention period
az keyvault create \
  --resource-group rg-az500-lab40 \
  --name $KV_NAME \
  --location southeastasia \
  --sku standard \
  --enable-rbac-authorization true \
  --enable-soft-delete true \
  --soft-delete-retention-days 90 \
  --enable-purge-protection true \
  --retention-days 90

# Lấy Key Vault resource ID
KV_ID=$(az keyvault show --name $KV_NAME --query id --output tsv)
echo "KV ID: $KV_ID"

# Gán Key Vault Administrator cho user hiện tại
USER_OID=$(az ad signed-in-user show --query id --output tsv)
az role assignment create \
  --assignee $USER_OID \
  --role "Key Vault Administrator" \
  --scope $KV_ID

# Xác nhận cấu hình
az keyvault show --name $KV_NAME \
  --query "{rbac:properties.enableRbacAuthorization, softDelete:properties.enableSoftDelete, purgeProtection:properties.enablePurgeProtection}" \
  --output json

# Tạo secret — db connection string
az keyvault secret set \
  --vault-name $KV_NAME \
  --name db-connection-string \
  --value "Server=sql01.southeastasia.cloudapp.azure.com;Database=appdb;User=sqladmin;Password=P@ss2026!" \
  --description "Production DB connection string"

# Tạo secret với expiry date (30 ngày)
EXPIRY_DATE=$(date -u -d '+30 days' '+%Y-%m-%dT%H:%MZ' 2>/dev/null || \
              date -u -v+30d '+%Y-%m-%dT%H:%MZ')
az keyvault secret set \
  --vault-name $KV_NAME \
  --name api-key-external \
  --value "sk-ext-$(openssl rand -hex 16)" \
  --expires "$EXPIRY_DATE"

# Đọc secret (cần Key Vault Secrets User hoặc Administrator)
az keyvault secret show \
  --vault-name $KV_NAME \
  --name db-connection-string \
  --query "value" \
  --output tsv

# Liệt kê tất cả secrets (chỉ tên, không hiển thị value)
az keyvault secret list \
  --vault-name $KV_NAME \
  --query "[].{Name:name, Enabled:attributes.enabled, Expires:attributes.expires}" \
  --output table

# Update secret → tạo version mới
az keyvault secret set \
  --vault-name $KV_NAME \
  --name db-connection-string \
  --value "Server=sql01.southeastasia.cloudapp.azure.com;Database=appdb;User=sqladmin;Password=NewP@ss2026!"

# Xem tất cả versions
az keyvault secret list-versions \
  --vault-name $KV_NAME \
  --name db-connection-string \
  --query "[].{Version:id, Created:attributes.created, Enabled:attributes.enabled}" \
  --output table

# Tạo RSA 2048 key
az keyvault key create \
  --vault-name $KV_NAME \
  --name app-encryption-key \
  --kty RSA \
  --size 2048 \
  --ops encrypt decrypt wrapKey unwrapKey sign verify

# Xem thông tin key
az keyvault key show \
  --vault-name $KV_NAME \
  --name app-encryption-key \
  --query "{keyId:key.kid, keyType:key.kty, keyOps:key.key_ops, enabled:attributes.enabled}" \
  --output json

# Tạo self-signed certificate với policy
# Cần tạo policy file JSON trước
cat > /tmp/cert-policy.json << 'EOF'
{
  "issuerParameters": { "name": "Self" },
  "keyProperties": {
    "exportable": true,
    "keySize": 2048,
    "keyType": "RSA",
    "reuseKey": false
  },
  "lifetimeActions": [{
    "action": { "actionType": "AutoRenew" },
    "trigger": { "daysBeforeExpiry": 30 }
  }],
  "secretProperties": { "contentType": "application/x-pkcs12" },
  "x509CertificateProperties": {
    "subject": "CN=app.hoatranlab.io.vn",
    "validityInMonths": 12,
    "keyUsage": ["digitalSignature", "keyEncipherment"],
    "ekus": ["1.3.6.1.5.5.7.3.1", "1.3.6.1.5.5.7.3.2"]
  }
}
EOF

az keyvault certificate create \
  --vault-name $KV_NAME \
  --name app-tls-cert \
  --policy @/tmp/cert-policy.json

# Đợi certificate được tạo (15–30 giây)
sleep 20

# Xem certificate info
az keyvault certificate show \
  --vault-name $KV_NAME \
  --name app-tls-cert \
  --query "{subject:policy.x509CertificateProperties.subject, expires:attributes.expires, thumbprint:x509Thumbprint}" \
  --output json

# Download certificate (PEM format)
az keyvault certificate download \
  --vault-name $KV_NAME \
  --name app-tls-cert \
  --file /tmp/app-tls-cert.pem \
  --encoding PEM
openssl x509 -in /tmp/app-tls-cert.pem -text -noout | grep -E "Subject:|Not After"

# Tạo storage account để lưu diagnostic logs
DIAG_STORAGE="staz500kvlog$(shuf -i 100-999 -n 1)"
az storage account create \
  --resource-group rg-az500-lab40 \
  --name $DIAG_STORAGE \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2

DIAG_STORAGE_ID=$(az storage account show \
  --resource-group rg-az500-lab40 \
  --name $DIAG_STORAGE --query id --output tsv)

# Bật diagnostic settings cho Key Vault (AuditEvent logs)
az monitor diagnostic-settings create \
  --resource $KV_ID \
  --name kv-audit-logs \
  --storage-account $DIAG_STORAGE_ID \
  --logs '[{"category":"AuditEvent","enabled":true,"retentionPolicy":{"days":90,"enabled":true}}]'

# Gán Key Vault Secrets User (read-only secrets) cho user/MI
# Role ID: 4633458b-17de-408a-b874-0445c86b69e6
az role assignment create \
  --assignee $USER_OID \
  --role "Key Vault Secrets User" \
  --scope "$KV_ID/secrets/db-connection-string"

# Test: đọc secret với Secrets User role (chỉ read, không set/delete)
az keyvault secret show \
  --vault-name $KV_NAME \
  --name db-connection-string \
  --query "value" --output tsv

# Xem tất cả role assignments trên Key Vault
az role assignment list \
  --scope $KV_ID \
  --query "[].{Principal:principalName, Role:roleDefinitionName, Scope:scope}" \
  --output table