Capstone: deploy a governed, monitored storage account, then audit the subscription clean

Steps

1. Prepare, and take stock before you build. Open Cloud Shell (Bash), choose your subscription, confirm lesson 1's budget is still there, and list any resource groups earlier labs may have left behind:

az account set --subscription 00000000-0000-0000-0000-000000000000
az consumption budget list --query '[].name' -o tsv
az group list --query "[?starts_with(name, 'az900-')].name" -o tsv

The first list prints your lesson 1 budget's name. Write down any az900- group the second one prints: the clean-up removes it. Then, in the Azure pricing calculator, estimate one Standard LRS storage account in East US with a small capacity, so you have a figure to compare with Cost Management later. Do not save or share the estimate. 2. Create the capstone's resource group with its tags, require the cost centre tag on everything inside it, and lock the group against deletion:

az group create --name az900-cap16-rg --location eastus --tags CostCenter=CC-1001 Environment=Lab
az policy definition show --name 871b6d14-10aa-478d-b590-94f262ecfa99 --query displayName -o tsv
az policy assignment create --name az900-cap16-require-costcenter --display-name "AZ-900 capstone require CostCenter" --policy 871b6d14-10aa-478d-b590-94f262ecfa99 --scope "$(az group show --name az900-cap16-rg --query id -o tsv)" --params '{"tagName": {"value": "CostCenter"}}'
az lock create --name az900-cap16-nodelete --lock-type CanNotDelete --resource-group az900-cap16-rg

The second command prints Require a tag on resources, a built-in definition with the deny effect. The tag on the group does not flow down, so from now on every resource you create in this group must carry its own CostCenter tag. 3. Write the ARM template. It declares one private storage account and gives it the cost centre tag from a parameter, so the policy is satisfied by design:

cat > az900-cap16.json << 'EOF'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageName": { "type": "string", "minLength": 3, "maxLength": 24 },
    "costCenter": { "type": "string", "defaultValue": "CC-1001" },
    "location": { "type": "string", "defaultValue": "[resourceGroup().location]" }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-05-01",
      "name": "[parameters('storageName')]",
      "location": "[parameters('location')]",
      "tags": { "CostCenter": "[parameters('costCenter')]", "Environment": "Lab" },
      "sku": { "name": "Standard_LRS" },
      "kind": "StorageV2",
      "properties": {
        "allowBlobPublicAccess": false,
        "minimumTlsVersion": "TLS1_2",
        "supportsHttpsTrafficOnly": true
      }
    }
  ],
  "outputs": {
    "storageId": { "type": "string", "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]" }
  }
}
EOF

4. Preview and deploy it. Replace the digits 48213 with four to six digits of your own, and use that name everywhere below:

az deployment group what-if --resource-group az900-cap16-rg --template-file az900-cap16.json --parameters storageName=az900cap1648213
az deployment group create --name az900-cap16-deploy --resource-group az900-cap16-rg --template-file az900-cap16.json --parameters storageName=az900cap1648213
SA_ID=$(az deployment group show --name az900-cap16-deploy --resource-group az900-cap16-rg --query properties.outputs.storageId.value -o tsv)
echo "$SA_ID"

What-if shows one resource to create; the deployment succeeds; the last line prints the account's resource ID, kept in SA_ID for step 6. 5. Test the governance. At least ten minutes after step 2, so the assignment has taken effect, try the imperative way without a tag, using a second name (your digits, with a t in front of them):

az storage account create --name az900cap16t48213 --resource-group az900-cap16-rg --location eastus --sku Standard_LRS --allow-blob-public-access false

It fails with RequestDisallowedByPolicy: your role allows the request, and the policy denies it. Next, confirm the lock is in place, and only if this prints CanNotDelete, try to delete the group:

az lock show --name az900-cap16-nodelete --resource-group az900-cap16-rg --query level -o tsv
az group delete --name az900-cap16-rg --yes

It fails with ScopeLocked: the Delete lock stops even an Owner. Both protections held, and neither one depended on which tool you used. 6. Add monitoring. Each create carries the CostCenter tag, because the policy denies anything in this group without one:

az monitor action-group create --name az900-cap16-ag --resource-group az900-cap16-rg --short-name az900cap16 --action email learner you@example.com --tags CostCenter=CC-1001
az monitor activity-log alert create --name az900-cap16-health --resource-group az900-cap16-rg --scope "/subscriptions/$(az account show --query id -o tsv)" --condition category=ServiceHealth --action-group az900-cap16-ag --tags CostCenter=CC-1001
az monitor metrics alert create --name az900-cap16-transactions --resource-group az900-cap16-rg --scopes "$SA_ID" --condition "total Transactions > 1000" --window-size 1h --evaluation-frequency 1h --action az900-cap16-ag --tags CostCenter=CC-1001 --description "Unexpectedly busy storage account"

Put your own email address in place of you@example.com. The first alert tells you about Azure's problems; the second about your own resource. Both send through the same action group. If SA_ID is empty because the session timed out, run the SA_ID= line from step 4 again. 7. Look at it all in the portal. Open the storage account: under Help, Resource health reads Available; under Monitoring, Metrics charts Transactions, a numeric time series. Open Advisor and filter to az900-cap16-rg: it may have recommendations for the new account, or none. Open Policy, then Compliance, and select AZ-900 capstone require CostCenter. Open Monitor, then Alerts, then Alert rules: both rules are listed. Open Cost Management, then Cost analysis, and group by the CostCenter tag; data for the account can take up to a day to appear, and the calculator's estimate from step 1 was the forward-looking figure for the same thing.