Azure Auto-Tagging Function

# Create a resource group for the function
az group create --name rg-auto-tagging --location eastus

# Create a storage account for the function
az storage account create --name stautotag[unique] \
    --resource-group rg-auto-tagging \
    --location eastus \
    --sku Standard_LRS

# Create the function app with PowerShell runtime
az functionapp create --name func-auto-tagging \
    --resource-group rg-auto-tagging \
    --storage-account stautotag[unique] \
    --consumption-plan-location eastus \
    --runtime powershell \
    --functions-version 4 \
    --os-type Windows

# Enable system-assigned managed identity
az functionapp identity assign \
    --name func-auto-tagging \
    --resource-group rg-auto-tagging

# Assign Contributor role to the function app's managed identity
# Get the principal ID first
principalId=$(az functionapp identity show \
    --name func-auto-tagging \
    --resource-group rg-auto-tagging \
    --query principalId -o tsv)

# Assign role at subscription level
az role assignment create \
    --assignee $principalId \
    --role "Contributor" \
    --scope "/subscriptions/$(az account show --query id -o tsv)"

# Input bindings are passed in via param block
param($eventGridEvent, $TriggerMetadata)

# Define tag schema
$tagSchema = @{
    "Creator" = $null
    "CreatedDate" = $null
    "Environment" = $null
    "Project" = $null
    "Department" = $null
    "IDSApplicationOwner-Symphony" = $null
}

# Initialize Azure context
Connect-AzAccount -Identity

# Process the event
try {
    # Extract resource information from the event
    $resourceId = $eventGridEvent.data.resourceUri
    $operationName = $eventGridEvent.data.operationName
    $status = $eventGridEvent.data.status
    $timestamp = $eventGridEvent.eventTime
    $claims = $eventGridEvent.data.claims
    
    # Log event information
    Write-Host "Processing event for resource: $resourceId"
    Write-Host "Operation: $operationName"
    Write-Host "Status: $status"
    
    # Only process resource creation events
    if ($operationName -like "*/write" -and $status -eq "Succeeded") {
        # Extract resource details
        $resourceGroup = ($resourceId -split '/')[4]
        $resourceType = ($resourceId -split '/')[6..7] -join '/'
        $resourceName = ($resourceId -split '/')[-1]
        
        # Get existing resource and its tags
        $resource = Get-AzResource -ResourceId $resourceId
        $existingTags = $resource.Tags
        if ($null -eq $existingTags) {
            $existingTags = @{}
        }
        
        # Prepare new tags
        $newTags = $existingTags.Clone()
        
        # Set Creator tag if not exists
        if (-not $newTags.ContainsKey("Creator")) {
            # Try to get creator from claims
            if ($claims.ContainsKey("name")) {
                $creator = $claims["name"]
            } elseif ($claims.ContainsKey("appid")) {
                $creator = "Service Principal: " + $claims["appid"]
            } else {
                $creator = "Unknown"
            }
            $newTags["Creator"] = $creator
        }
        
        # Set CreatedDate tag if not exists
        if (-not $newTags.ContainsKey("CreatedDate")) {
            $newTags["CreatedDate"] = (Get-Date $timestamp).ToString("yyyy-MM-dd")
        }
        
        # Try to determine Environment from resource group name
        if (-not $newTags.ContainsKey("Environment")) {
            if ($resourceGroup -match "prod|production") {
                $newTags["Environment"] = "Production"
            } elseif ($resourceGroup -match "dev|development") {
                $newTags["Environment"] = "Development"
            } elseif ($resourceGroup -match "test|testing|qa") {
                $newTags["Environment"] = "Test"
            } elseif ($resourceGroup -match "stage|staging") {
                $newTags["Environment"] = "Staging"
            } else {
                $newTags["Environment"] = "Unknown"
            }
        }
        
        # Try to determine Project from resource group name
        if (-not $newTags.ContainsKey("Project")) {
            # Extract project code if resource group follows naming convention
            if ($resourceGroup -match "rg-([a-zA-Z0-9]+)") {
                $newTags["Project"] = $matches[1]
            } else {
                $newTags["Project"] = "Unknown"
            }
        }
        
        # Set Department tag if not exists
        if (-not $newTags.ContainsKey("Department")) {
            # Try to determine from subscription
            $subscription = (Get-AzContext).Subscription.Name
            if ($subscription -match "finance|accounting") {
                $newTags["Department"] = "Finance"
            } elseif ($subscription -match "it|infra") {
                $newTags["Department"] = "IT"
            } elseif ($subscription -match "hr|human") {
                $newTags["Department"] = "HR"
            } elseif ($subscription -match "sales|marketing") {
                $newTags["Department"] = "Sales"
            } else {
                $newTags["Department"] = "Unknown"
            }
        }
        
        # Set IDSApplicationOwner-Symphony tag if not exists
        if (-not $newTags.ContainsKey("IDSApplicationOwner-Symphony")) {
            if ($claims.ContainsKey("name")) {
                $newTags["IDSApplicationOwner-Symphony"] = $claims["name"]
            } else {
                $newTags["IDSApplicationOwner-Symphony"] = "Unknown"
            }
        }
        
        # Apply tags if they've changed
        if (($newTags.Count -gt $existingTags.Count) -or 
            ($newTags.Keys | Where-Object { $newTags[$_] -ne $existingTags[$_] })) {
            
            Write-Host "Applying tags to resource: $resourceName"
            
            # Update resource tags
            Update-AzTag -ResourceId $resourceId -Tag $newTags -Operation Merge
            
            Write-Host "Tags applied successfully"
        } else {
            Write-Host "No new tags to apply"
        }
    } else {
        Write-Host "Skipping event - not a successful resource creation"
    }
} catch {
    Write-Error "Error processing event: $_"
    throw $_
}

# Get the function URL and key
functionUrl=$(az functionapp function show \
    --name func-auto-tagging \
    --resource-group rg-auto-tagging \
    --function-name AutoTagResources \
    --query invokeUrlTemplate -o tsv)

functionKey=$(az functionapp function keys list \
    --name func-auto-tagging \
    --resource-group rg-auto-tagging \
    --function-name AutoTagResources \
    --query default -o tsv)

# Create the event grid subscription
az eventgrid event-subscription create \
    --name "resource-auto-tagging" \
    --source-resource-id "/subscriptions/$(az account show --query id -o tsv)" \
    --endpoint $functionUrl \
    --endpoint-type azurefunction \
    --included-event-types Microsoft.Resources.ResourceWriteSuccess \
    --subject-begins-with "/subscriptions/" \
    --advanced-filter data.operationName StringContains "Microsoft.Resources/deployments/write" "Microsoft.Resources/deployments/validate/action"

# List event grid subscriptions
az eventgrid event-subscription list \
    --source-resource-id "/subscriptions/$(az account show --query id -o tsv)" \
    --query "[?name=='resource-auto-tagging']"

# Check function app status
az functionapp show --name func-auto-tagging --resource-group rg-auto-tagging --query state

# View detailed function logs
az functionapp log tail --name func-auto-tagging --resource-group rg-auto-tagging

# Check managed identity configuration
az functionapp identity show --name func-auto-tagging --resource-group rg-auto-tagging

# Verify role assignments
principalId=$(az functionapp identity show --name func-auto-tagging --resource-group rg-auto-tagging --query principalId -o tsv)
az role assignment list --assignee $principalId

# Check Event Grid subscription
az eventgrid event-subscription show --name "resource-auto-tagging" --source-resource-id "/subscriptions/$(az account show --query id -o tsv)"

# Add to PowerShell script to create ServiceNow change requests for remediation
if ($requiresRemediation) {
    $snowParams = @{
        Uri = "https://your-instance.service-now.com/api/now/table/change_request"
        Method = "POST"
        Headers = @{
            "Accept" = "application/json"
            "Content-Type" = "application/json"
            "Authorization" = "Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("username:password"))
        }
        Body = @{
            short_description = "Tag remediation for $resourceName"
            description = "Resource $resourceId requires tag remediation"
            category = "Other"
            priority = "4"
        } | ConvertTo-Json
    }
    
    Invoke-RestMethod @snowParams
}

# Sample PowerShell script for tag compliance reporting
$resources = Get-AzResource
$report = @()

foreach ($resource in $resources) {
    $compliance = @{
        ResourceId = $resource.ResourceId
        ResourceName = $resource.Name
        ResourceType = $resource.ResourceType
        ResourceGroup = $resource.ResourceGroupName
        MissingTags = @()
        IncompleteValues = @()
    }
    
    # Check for required tags
    foreach ($tag in @("Creator", "CreatedDate", "Environment", "Project", "Department", "IDSApplicationOwner-Symphony")) {
        if (-not $resource.Tags -or -not $resource.Tags.ContainsKey($tag)) {
            $compliance.MissingTags += $tag
        } elseif ($resource.Tags[$tag] -eq "Unknown" -or [string]::IsNullOrEmpty($resource.Tags[$tag])) {
            $compliance.IncompleteValues += $tag
        }
    }
    
    if ($compliance.MissingTags.Count -gt 0 -or $compliance.IncompleteValues.Count -gt 0) {
        $report += [PSCustomObject]$compliance
    }
}

$report | Export-Csv -Path "TagComplianceReport.csv" -NoTypeInformation