Identity, Security, Cost & Governance

# Tạo resource group lab
# =========================
# Lab 06 - AZ-900 Governance & Cost Management
# Cloud Shell Bash / Linux / macOS
# =========================

RG_NAME="rg-az900-lab06"
LOCATION="southeastasia"
BUDGET_NAME="budget-learning-10usd"
CONTACT_EMAIL="[email protected]"
USER_EMAIL="[email protected]"

# 1. Tạo Resource Group
az group create \
  --name "$RG_NAME" \
  --location "$LOCATION"

# 2. Lấy Subscription ID
SUB_ID=$(az account show --query id -o tsv)
echo "Subscription ID: $SUB_ID"

# 3. Tạo Budget Notification file
cat > budget-notifications.json << EOF
{
  "Actual_GreaterThan_80_Percent": {
    "enabled": true,
    "operator": "GreaterThan",
    "threshold": 80,
    "contactEmails": [
      "$CONTACT_EMAIL"
    ],
    "thresholdType": "Actual"
  },
  "Actual_GreaterThan_100_Percent": {
    "enabled": true,
    "operator": "GreaterThan",
    "threshold": 100,
    "contactEmails": [
      "$CONTACT_EMAIL"
    ],
    "thresholdType": "Actual"
  }
}
EOF

cat > budget-time-period.json << EOF
{
  "startDate": "2026-05-01",
  "endDate": "2026-12-31"
}
EOF

# 4. Tạo Budget có Alert
az consumption budget create-with-rg \
  --budget-name "$BUDGET_NAME" \
  --resource-group "$RG_NAME" \
  --amount 10 \
  --category Cost \
  --time-grain Monthly \
  --time-period @budget-time-period.json \
  --notifications @budget-notifications.json

# 5. Lấy Object ID của user
USER_OID=$(az ad user show \
  --id "$USER_EMAIL" \
  --query id \
  -o tsv)

if [ -z "$USER_OID" ]; then
  echo "Không tìm thấy user: $USER_EMAIL"
  echo "Hãy thay USER_EMAIL bằng email user thật trong Microsoft Entra ID."
  exit 1
fi

# 6. Gán Reader role ở scope Resource Group
az role assignment create \
  --assignee-object-id "$USER_OID" \
  --assignee-principal-type User \
  --role "Reader" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/$RG_NAME"

# 7. Liệt kê role assignment
az role assignment list \
  --resource-group "$RG_NAME" \
  --query "[].{Principal:principalName,Role:roleDefinitionName,Scope:scope}" \
  --output table

# 8. Xem một số built-in roles
az role definition list \
  --query "[?roleType=='BuiltInRole'].{Name:roleName}" \
  --output table | head -20

# 9. Tạo Resource Lock
az lock create \
  --name "lock-no-delete-lab06" \
  --resource-group "$RG_NAME" \
  --lock-type CanNotDelete \
  --notes "Lock created for AZ-900 lab - do not remove during training"

# 10. Xem lock
az lock list \
  --resource-group "$RG_NAME" \
  --output table

# 11. Xem Cost Usage
az consumption usage list \
  --start-date "2026-05-01" \
  --end-date "2026-05-31" \
  --query "[].{Service:instanceName,Cost:pretaxCost,Currency:currency}" \
  --output table || echo "No usage data yet or this subscription does not support this API."

# 12. Xem budget
az consumption budget list \
  --resource-group "$RG_NAME" \
  --output table

# Xóa lock (nếu chưa xóa ở bước trên)
az lock delete --name "lock-no-delete-lab06" \
  --resource-group rg-az900-lab06 2>/dev/null

# Xóa resource group
az group delete --name rg-az900-lab06 --yes --no-wait

echo "Cleanup done. Congratulations — AZ-900 lab series complete!"