Key Vault Private Endpoint — Private DNS + RBAC + Managed Identity

# Tạo resource group
az group create --name rg-az500-lab41 --location southeastasia

# Tạo VNet với 2 subnet
az network vnet create \
  --resource-group rg-az500-lab41 \
  --name vnet-az500-lab41 \
  --address-prefix 10.41.0.0/16 \
  --subnet-name snet-vm-lab41 \
  --subnet-prefix 10.41.1.0/24

az network vnet subnet create \
  --resource-group rg-az500-lab41 \
  --vnet-name vnet-az500-lab41 \
  --name snet-pe-lab41 \
  --address-prefix 10.41.2.0/24

# Tắt Private Endpoint Network Policies trên subnet PE (bắt buộc)
az network vnet subnet update \
  --resource-group rg-az500-lab41 \
  --vnet-name vnet-az500-lab41 \
  --name snet-pe-lab41 \
  --disable-private-endpoint-network-policies true

# Tạo Key Vault (RBAC + soft delete + purge protection)
KV_NAME="kv-az500-lab41-$(shuf -i 100-999 -n 1)"
echo "Key Vault: $KV_NAME"

az keyvault create \
  --resource-group rg-az500-lab41 \
  --name $KV_NAME \
  --location southeastasia \
  --sku standard \
  --enable-rbac-authorization true \
  --enable-soft-delete true \
  --soft-delete-retention-days 90 \
  --enable-purge-protection true

# Gán Key Vault Administrator cho user hiện tại
KV_ID=$(az keyvault show --name $KV_NAME --query id --output tsv)
USER_OID=$(az ad signed-in-user show --query id --output tsv)
az role assignment create \
  --assignee $USER_OID \
  --role "Key Vault Administrator" \
  --scope $KV_ID

# Tạo secret test
az keyvault secret set \
  --vault-name $KV_NAME \
  --name app-db-password \
  --value "SuperSecret2026!"

echo "Setup hoàn tất. KV_NAME=$KV_NAME"

# Lấy subnet ID cho private endpoint
PE_SUBNET_ID=$(az network vnet subnet show \
  --resource-group rg-az500-lab41 \
  --vnet-name vnet-az500-lab41 \
  --name snet-pe-lab41 \
  --query id --output tsv)

# Tạo Private Endpoint cho Key Vault
# --group-id vault = sub-resource của Key Vault
az network private-endpoint create \
  --resource-group rg-az500-lab41 \
  --name pe-kv-lab41 \
  --vnet-name vnet-az500-lab41 \
  --subnet snet-pe-lab41 \
  --private-connection-resource-id $KV_ID \
  --group-id vault \
  --connection-name conn-kv-lab41 \
  --location southeastasia

# Xem private IP được gán cho endpoint
az network private-endpoint show \
  --resource-group rg-az500-lab41 \
  --name pe-kv-lab41 \
  --query "customDnsConfigs[].{FQDN:fqdn, IP:ipAddresses}" \
  --output table

# Tạo Private DNS Zone cho Key Vault
az network private-dns zone create \
  --resource-group rg-az500-lab41 \
  --name "privatelink.vaultcore.azure.net"

# Link DNS Zone với VNet
az network private-dns link vnet create \
  --resource-group rg-az500-lab41 \
  --zone-name "privatelink.vaultcore.azure.net" \
  --name dns-link-vnet-lab41 \
  --virtual-network vnet-az500-lab41 \
  --registration-enabled false

# Tạo DNS record set từ private endpoint
PE_NIC_ID=$(az network private-endpoint show \
  --resource-group rg-az500-lab41 \
  --name pe-kv-lab41 \
  --query "networkInterfaces[0].id" --output tsv)

PE_IP=$(az network nic show \
  --ids $PE_NIC_ID \
  --query "ipConfigurations[0].privateIPAddress" --output tsv)
echo "Private IP của KV endpoint: $PE_IP"

# Tạo A record trong Private DNS Zone
az network private-dns record-set a create \
  --resource-group rg-az500-lab41 \
  --zone-name "privatelink.vaultcore.azure.net" \
  --name $KV_NAME

az network private-dns record-set a add-record \
  --resource-group rg-az500-lab41 \
  --zone-name "privatelink.vaultcore.azure.net" \
  --record-set-name $KV_NAME \
  --ipv4-address $PE_IP

# TẮT public network access của Key Vault
# SAU KHI Private Endpoint đã được tạo và DNS đã cấu hình
az keyvault update \
  --resource-group rg-az500-lab41 \
  --name $KV_NAME \
  --public-network-access Disabled

# Xác nhận public access đã tắt
az keyvault show --name $KV_NAME \
  --query "properties.publicNetworkAccess" --output tsv
# Output: Disabled

# Tạo VM Linux (không public IP, dùng Bastion hoặc serial console để test)
# Dùng VM size nhỏ nhất để tiết kiệm chi phí
az vm create \
  --resource-group rg-az500-lab41 \
  --name vm-az500-lab41 \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --vnet-name vnet-az500-lab41 \
  --subnet snet-vm-lab41 \
  --public-ip-address "" \
  --admin-username azureuser \
  --generate-ssh-keys \
  --assign-identity \
  --location southeastasia

# Lấy managed identity principal ID của VM
VM_MI_OID=$(az vm identity show \
  --resource-group rg-az500-lab41 \
  --name vm-az500-lab41 \
  --query principalId --output tsv)
echo "VM Managed Identity OID: $VM_MI_OID"

# Gán Key Vault Secrets User (read secrets only) cho managed identity
az role assignment create \
  --assignee-object-id $VM_MI_OID \
  --assignee-principal-type ServicePrincipal \
  --role "Key Vault Secrets User" \
  --scope $KV_ID

# Xác nhận role assignment
az role assignment list \
  --scope $KV_ID \
  --query "[?principalId=='$VM_MI_OID'].{Role:roleDefinitionName, Principal:principalId}" \
  --output table

# Script chạy bên trong VM để test toàn bộ flow
# Thay KV_NAME bằng tên thực tế
cat > /tmp/test-keyvault.sh << SCRIPT
#!/bin/bash
KV_NAME="REPLACE_WITH_KV_NAME"

echo "=== 1. Kiểm tra DNS resolution ==="
nslookup \${KV_NAME}.vault.azure.net
# Phải resolve về 10.41.2.x (private IP), KHÔNG phải public IP

echo ""
echo "=== 2. Lấy Access Token từ IMDS (managed identity) ==="
TOKEN=$(curl -s \
  "http://169.254.169.254/metadata/identity/oauth2/token?\
api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net" \
  -H "Metadata: true" | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
echo "Token lấy thành công (prefix): \${TOKEN:0:50}..."

echo ""
echo "=== 3. Đọc secret từ Key Vault qua private endpoint ==="
SECRET=$(curl -s \
  "https://\${KV_NAME}.vault.azure.net/secrets/app-db-password?api-version=7.4" \
  -H "Authorization: Bearer \$TOKEN" | \
  python3 -c "import sys,json; print(json.load(sys.stdin)['value'])")
echo "Secret value: \$SECRET"

echo ""
echo "=== 4. Xác nhận public access bị chặn (từ local machine) ==="
echo "Từ máy bên ngoài VNet, thử: curl https://\${KV_NAME}.vault.azure.net/secrets"
echo "Sẽ nhận: 403 Forbidden (public network access disabled)"
SCRIPT

# Thay KV_NAME trong script
sed -i "s/REPLACE_WITH_KV_NAME/$KV_NAME/g" /tmp/test-keyvault.sh

# Chạy script trên VM qua az vm run-command
az vm run-command invoke \
  --resource-group rg-az500-lab41 \
  --name vm-az500-lab41 \
  --command-id RunShellScript \
  --scripts "$(cat /tmp/test-keyvault.sh)"