Final project: build it, break it, fix it

@description('Location for all resources')
param location string = resourceGroup().location

@description('Admin user name on both web VMs')
param adminUsername string = 'azureuser'

@description('SSH public key for the admin user')
param adminPublicKey string

@description('Object ID of the person running the lab (az ad signed-in-user show --query id)')
param adminObjectId string

@secure()
@description('Value stored in Key Vault as db-password')
param dbPassword string

var suffix = take(uniqueString(resourceGroup().id), 10)
var stName = 'stsm${suffix}'
var kvName = 'kv-sm-${suffix}'
var vmNames = [
  'vm-web1'
  'vm-web2'
]
var tags = {
  course: 'saatvedha-azure'
  lesson: '74'
  app: 'saatmart'
}
var cloudInit = '''
#cloud-config
package_update: true
packages:
  - nginx
runcmd:
  - hostname > /var/www/html/index.html
  - echo ok > /var/www/html/health
'''
var roles = {
  kvAdmin: '00482a5a-887f-4fb3-b363-3b7fe8e74483'
  kvSecretsUser: '4633458b-17de-408a-b874-0445c86b69e6'
  blobReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
}

// ---------- Network ----------
resource nsgWeb 'Microsoft.Network/networkSecurityGroups@2024-05-01' = {
  name: 'nsg-web'
  location: location
  tags: tags
  properties: {
    securityRules: [
      {
        name: 'allow-http'
        properties: {
          priority: 100
          direction: 'Inbound'
          access: 'Allow'
          protocol: 'Tcp'
          sourceAddressPrefix: 'Internet'
          sourcePortRange: '*'
          destinationAddressPrefix: '*'
          destinationPortRange: '80'
        }
      }
    ]
  }
}

resource vnet 'Microsoft.Network/virtualNetworks@2024-05-01' = {
  name: 'vnet-saatmart'
  location: location
  tags: tags
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.90.0.0/16'
      ]
    }
    subnets: [
      {
        name: 'snet-web'
        properties: {
          addressPrefix: '10.90.1.0/24'
          defaultOutboundAccess: false
          networkSecurityGroup: {
            id: nsgWeb.id
          }
        }
      }
      {
        name: 'snet-data'
        properties: {
          addressPrefix: '10.90.2.0/24'
          defaultOutboundAccess: false
        }
      }
    ]
  }
}

resource pipLb 'Microsoft.Network/publicIPAddresses@2024-05-01' = {
  name: 'pip-saatmart'
  location: location
  tags: tags
  sku: {
    name: 'Standard'
  }
  zones: [
    '1'
    '2'
    '3'
  ]
  properties: {
    publicIPAllocationMethod: 'Static'
  }
}

resource lb 'Microsoft.Network/loadBalancers@2024-05-01' = {
  name: 'lb-saatmart'
  location: location
  tags: tags
  sku: {
    name: 'Standard'
  }
  properties: {
    frontendIPConfigurations: [
      {
        name: 'fe-web'
        properties: {
          publicIPAddress: {
            id: pipLb.id
          }
        }
      }
    ]
    backendAddressPools: [
      {
        name: 'pool-web'
      }
    ]
    probes: [
      {
        name: 'probe-http'
        properties: {
          protocol: 'Http'
          port: 80
          requestPath: '/health'
          intervalInSeconds: 5
          numberOfProbes: 1
          probeThreshold: 1
        }
      }
    ]
    loadBalancingRules: [
      {
        name: 'rule-http'
        properties: {
          frontendIPConfiguration: {
            id: resourceId('Microsoft.Network/loadBalancers/frontendIPConfigurations', 'lb-saatmart', 'fe-web')
          }
          backendAddressPool: {
            id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', 'lb-saatmart', 'pool-web')
          }
          probe: {
            id: resourceId('Microsoft.Network/loadBalancers/probes', 'lb-saatmart', 'probe-http')
          }
          protocol: 'Tcp'
          frontendPort: 80
          backendPort: 80
          disableOutboundSnat: true
        }
      }
    ]
    outboundRules: [
      {
        name: 'out-web'
        properties: {
          frontendIPConfigurations: [
            {
              id: resourceId('Microsoft.Network/loadBalancers/frontendIPConfigurations', 'lb-saatmart', 'fe-web')
            }
          ]
          backendAddressPool: {
            id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', 'lb-saatmart', 'pool-web')
          }
          protocol: 'All'
          allocatedOutboundPorts: 10000
        }
      }
    ]
  }
}

// ---------- Web VMs ----------
resource nics 'Microsoft.Network/networkInterfaces@2024-05-01' = [for (vm, i) in vmNames: {
  name: '${vm}-nic'
  location: location
  tags: tags
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          subnet: {
            id: '${vnet.id}/subnets/snet-web'
          }
          privateIPAllocationMethod: 'Static'
          privateIPAddress: '10.90.1.${i + 4}'
          loadBalancerBackendAddressPools: [
            {
              id: lb.properties.backendAddressPools[0].id
            }
          ]
        }
      }
    ]
  }
}]

resource vms 'Microsoft.Compute/virtualMachines@2024-07-01' = [for (vm, i) in vmNames: {
  name: vm
  location: location
  tags: tags
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    hardwareProfile: {
      vmSize: 'Standard_B1s'
    }
    osProfile: {
      computerName: vm
      adminUsername: adminUsername
      customData: base64(cloudInit)
      linuxConfiguration: {
        disablePasswordAuthentication: true
        ssh: {
          publicKeys: [
            {
              path: '/home/${adminUsername}/.ssh/authorized_keys'
              keyData: adminPublicKey
            }
          ]
        }
      }
    }
    storageProfile: {
      imageReference: {
        publisher: 'Canonical'
        offer: 'ubuntu-24_04-lts'
        sku: 'server'
        version: 'latest'
      }
      osDisk: {
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: 'StandardSSD_LRS'
        }
      }
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nics[i].id
        }
      ]
    }
    diagnosticsProfile: {
      bootDiagnostics: {
        enabled: true
      }
    }
  }
}]

resource ama 'Microsoft.Compute/virtualMachines/extensions@2024-07-01' = [for (vm, i) in vmNames: {
  parent: vms[i]
  name: 'AzureMonitorLinuxAgent'
  location: location
  properties: {
    publisher: 'Microsoft.Azure.Monitor'
    type: 'AzureMonitorLinuxAgent'
    typeHandlerVersion: '1.0'
    autoUpgradeMinorVersion: true
    enableAutomaticUpgrade: true
  }
}]

// ---------- Monitoring ----------
resource law 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: 'law-saatmart'
  location: location
  tags: tags
  properties: {
    sku: {
      name: 'PerGB2018'
    }
    retentionInDays: 30
    workspaceCapping: {
      dailyQuotaGb: json('0.1')
    }
  }
}

resource dcr 'Microsoft.Insights/dataCollectionRules@2022-06-01' = {
  name: 'dcr-saatmart'
  location: location
  tags: tags
  kind: 'Linux'
  properties: {
    dataSources: {
      syslog: [
        {
          name: 'syslog-warn'
          streams: [
            'Microsoft-Syslog'
          ]
          facilityNames: [
            'daemon'
            'syslog'
            'user'
          ]
          logLevels: [
            'Warning'
            'Error'
            'Critical'
            'Alert'
            'Emergency'
          ]
        }
      ]
    }
    destinations: {
      logAnalytics: [
        {
          name: 'law'
          workspaceResourceId: law.id
        }
      ]
    }
    dataFlows: [
      {
        streams: [
          'Microsoft-Syslog'
        ]
        destinations: [
          'law'
        ]
      }
    ]
  }
}

resource dcra 'Microsoft.Insights/dataCollectionRuleAssociations@2022-06-01' = [for (vm, i) in vmNames: {
  name: 'dcra-saatmart'
  scope: vms[i]
  properties: {
    dataCollectionRuleId: dcr.id
  }
}]

// ---------- Storage behind a private endpoint ----------
resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: stName
  location: location
  tags: tags
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
    publicNetworkAccess: 'Disabled'
  }
}

resource blobSvc 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {
  parent: st
  name: 'default'
}

resource docs 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01' = {
  parent: blobSvc
  name: 'docs'
}

resource pe 'Microsoft.Network/privateEndpoints@2024-05-01' = {
  name: 'pe-blob'
  location: location
  tags: tags
  properties: {
    subnet: {
      id: '${vnet.id}/subnets/snet-data'
    }
    privateLinkServiceConnections: [
      {
        name: 'pe-blob-conn'
        properties: {
          privateLinkServiceId: st.id
          groupIds: [
            'blob'
          ]
        }
      }
    ]
  }
}

resource zone 'Microsoft.Network/privateDnsZones@2024-06-01' = {
  name: 'privatelink.blob.${environment().suffixes.storage}'
  location: 'global'
  tags: tags
}

resource zoneLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = {
  parent: zone
  name: 'link-saatmart'
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: vnet.id
    }
  }
}

resource zoneGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2024-05-01' = {
  parent: pe
  name: 'default'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'blob'
        properties: {
          privateDnsZoneId: zone.id
        }
      }
    ]
  }
}

// ---------- Key Vault ----------
resource kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: kvName
  location: location
  tags: tags
  properties: {
    tenantId: subscription().tenantId
    sku: {
      family: 'A'
      name: 'standard'
    }
    enableRbacAuthorization: true
    softDeleteRetentionInDays: 7
  }
}

resource secret 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = {
  parent: kv
  name: 'db-password'
  properties: {
    value: dbPassword
  }
}

// ---------- Role assignments ----------
resource kvAdminRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(kv.id, adminObjectId, roles.kvAdmin)
  scope: kv
  properties: {
    principalId: adminObjectId
    principalType: 'User'
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roles.kvAdmin)
  }
}

resource vmSecretRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for (vm, i) in vmNames: {
  name: guid(secret.id, vm, roles.kvSecretsUser)
  scope: secret
  properties: {
    principalId: vms[i].identity.principalId
    principalType: 'ServicePrincipal'
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roles.kvSecretsUser)
  }
}]

resource vmBlobRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for (vm, i) in vmNames: {
  name: guid(st.id, vm, roles.blobReader)
  scope: st
  properties: {
    principalId: vms[i].identity.principalId
    principalType: 'ServicePrincipal'
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roles.blobReader)
  }
}]

output lbIp string = pipLb.properties.ipAddress
output storageName string = st.name
output keyVaultName string = kv.name
output workspaceId string = law.properties.customerId

param(
    [string]$ResourceGroup = 'rg-saatmart',
    [Parameter(Mandatory)][ValidateRange(1, 10)][int]$Scenario
)
# SaatVedha Azure Lesson 74: break SaatMart in one of ten ways.
# Try to fix each one with Test-SaatMart.ps1 and the course tools before you read this switch.
$rg = $ResourceGroup
$o = az deployment group show --resource-group $rg --name saatmart --query properties.outputs -o json | ConvertFrom-Json
$kv = $o.keyVaultName.value
switch ($Scenario) {
    1 { az network nsg rule delete --resource-group $rg --nsg-name nsg-web --name allow-http }
    2 { az network lb probe update --resource-group $rg --lb-name lb-saatmart --name probe-http --path /status -o none }
    3 { az network private-dns link vnet delete --resource-group $rg --zone-name privatelink.blob.core.windows.net --name link-saatmart --yes }
    4 {
        $p = az vm show --resource-group $rg --name vm-web1 --query identity.principalId -o tsv
        $kvId = az keyvault show --name $kv --query id -o tsv
        az role assignment delete --assignee $p --role 'Key Vault Secrets User' --scope "$kvId/secrets/db-password"
    }
    5 {
        az network route-table create --resource-group $rg --name rt-saatmart -o none
        az network route-table route create --resource-group $rg --route-table-name rt-saatmart --name default-route --address-prefix 0.0.0.0/0 --next-hop-type None -o none
        az network vnet subnet update --resource-group $rg --vnet-name vnet-saatmart --name snet-web --route-table rt-saatmart -o none
    }
    6 { az vm stop --resource-group $rg --name vm-web2 -o none }
    7 {
        $id = az vm show --resource-group $rg --name vm-web2 --query id -o tsv
        az rest --method delete --url "https://management.azure.com${id}/providers/Microsoft.Insights/dataCollectionRuleAssociations/dcra-saatmart?api-version=2022-06-01"
    }
    8 {
        $rgId = az group show --name $rg --query id -o tsv
        '{"listOfAllowedLocations":{"value":["southindia"]}}' | Set-Content "$PSScriptRoot\break8.json"
        az policy assignment create --name allowed-loc-saatmart --policy e56962a6-4747-49cd-b67b-bf8b01975c4c --scope $rgId --params "@$PSScriptRoot\break8.json" -o none
    }
    9 { az keyvault secret delete --vault-name $kv --name db-password -o none }
    10 { az network lb outbound-rule delete --resource-group $rg --lb-name lb-saatmart --name out-web }
}
"Scenario $Scenario applied. Wait 5 to 10 minutes, then run Test-SaatMart.ps1."