Azure Services Deep Dive Questions

terraform {
  required_providers {
    azurerm = { source = "hashicorp/azurerm" version = "~>3.0" }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "rg" {
  name     = var.resource_group_name
  location = var.location
  tags     = var.tags
}

resource "azurerm_virtual_network" "vnet" {
  name                = "${var.name_prefix}-vnet"
  address_space       = var.vnet_address_space
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  tags                = var.tags
}

resource "azurerm_subnet" "app" {
  name                 = "${var.name_prefix}-app-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = [var.app_subnet_prefix]
}

resource "azurerm_subnet" "db" {
  name                 = "${var.name_prefix}-db-subnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = [var.db_subnet_prefix]
}

resource "azurerm_network_security_group" "app_nsg" {
  name                = "${var.name_prefix}-app-nsg"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  tags                = var.tags

  security_rule {
    name                       = "Allow-HTTP"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "0.0.0.0/0"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Allow-HTTPS"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "0.0.0.0/0"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Deny-All-Inbound"
    priority                   = 200
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "0.0.0.0/0"
    destination_address_prefix = "*"
  }
}

resource "azurerm_subnet_network_security_group_association" "app_assoc" {
  subnet_id                 = azurerm_subnet.app.id
  network_security_group_id = azurerm_network_security_group.app_nsg.id
}

variable "name_prefix" {
  type        = string
  description = "Prefix for resource names"
}

variable "resource_group_name" {
  type        = string
  description = "Resource group name to create/use"
}

variable "location" {
  type        = string
  default     = "eastus"
}

variable "vnet_address_space" {
  type    = list(string)
  default = ["10.0.0.0/16"]
}

variable "app_subnet_prefix" {
  type    = string
  default = "10.0.1.0/24"
}

variable "db_subnet_prefix" {
  type    = string
  default = "10.0.2.0/24"
}

variable "tags" {
  type = map(string)
  description = "Tags to apply (e.g., environment, owner)"
  default = { environment = "dev", owner = "team@example.com" }
}

AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where Level == "Error" or Level_s == "Error" or SeverityLevel == 3  // cover common columns
| summarize Errors = count() by Resource = coalesce(Resource, ResourceId, tostring(ResourceId_s))
| order by Errors desc
| extend TotalErrors = tolong(sum(Errors) over ()), Percent = round(100.0 * Errors / TotalErrors, 2)
| top 5 by Errors
| project Resource, Errors, Percent