Seguridad en Azure Storage: Guía Completa de Firewall, Resource Instances y Mejores Prácticas

# Agregar regla de VNet
Add-AzStorageAccountNetworkRule `
    -ResourceGroupName "myRG" `
    -Name "mystorageaccount" `
    -VirtualNetworkResourceId "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/subnet"

# Agregar regla de IP
Add-AzStorageAccountNetworkRule `
    -ResourceGroupName "myRG" `
    -Name "mystorageaccount" `
    -IPAddressOrRange "203.0.113.0/24"

# Agregar Resource Instance
Add-AzStorageAccountNetworkRule `
    -ResourceGroupName "myRG" `
    -Name "mystorageaccount" `
    -TenantId "your-tenant-id" `
    -ResourceId "/subscriptions/xxx/resourceGroups/rg/providers/Microsoft.Synapse/workspaces/myworkspace"

# Habilitar Trusted Services
Update-AzStorageAccountNetworkRuleSet `
    -ResourceGroupName "myRG" `
    -Name "mystorageaccount" `
    -Bypass AzureServices,Logging,Metrics

# Variables
$rgName = "myResourceGroup"
$storageAccount = "mystorageaccount"
$synapseWorkspaceName = "prod-synapse"
$synapseRG = "synapse-rg"
$tenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# 1. Obtener Resource ID del Synapse Workspace
$synapseResourceId = (Get-AzSynapseWorkspace `
    -ResourceGroupName $synapseRG `
    -Name $synapseWorkspaceName).Id

# 2. Configurar firewall restrictivo
Update-AzStorageAccountNetworkRuleSet `
    -ResourceGroupName $rgName `
    -Name $storageAccount `
    -DefaultAction Deny `
    -Bypass Logging,Metrics

# 3. Agregar Resource Instance Rule
Add-AzStorageAccountNetworkRule `
    -ResourceGroupName $rgName `
    -Name $storageAccount `
    -TenantId $tenantId `
    -ResourceId $synapseResourceId

# 4. Obtener Managed Identity Object ID
$workspace = Get-AzSynapseWorkspace `
    -ResourceGroupName $synapseRG `
    -Name $synapseWorkspaceName
$principalId = $workspace.Identity.PrincipalId

# 5. Asignar rol RBAC para acceso a datos
New-AzRoleAssignment `
    -ObjectId $principalId `
    -RoleDefinitionName "Storage Blob Data Contributor" `
    -Scope "/subscriptions/$((Get-AzContext).Subscription.Id)/resourceGroups/$rgName/providers/Microsoft.Storage/storageAccounts/$storageAccount"

Write-Host "✅ Configuración completa!" -ForegroundColor Green

# 1. Configurar firewall restrictivo con excepciones de lectura
Update-AzStorageAccountNetworkRuleSet `
    -ResourceGroupName "myRG" `
    -Name "mystorageaccount" `
    -DefaultAction Deny `
    -Bypass Logging,Metrics  # SIN AzureServices (a menos que uses Azure Backup)

# 2. Agregar Resource Instances específicas
$resources = @(
    "/subscriptions/xxx/resourceGroups/rg1/providers/Microsoft.Synapse/workspaces/prod-synapse",
    "/subscriptions/xxx/resourceGroups/rg1/providers/Microsoft.DataFactory/factories/prod-adf",
    "/subscriptions/xxx/resourceGroups/rg1/providers/Microsoft.Databricks/workspaces/prod-dbx"
)

foreach ($resourceId in $resources) {
    Add-AzStorageAccountNetworkRule `
        -ResourceGroupName "myRG" `
        -Name "mystorageaccount" `
        -TenantId "your-tenant-id" `
        -ResourceId $resourceId
}

# 3. Agregar IPs de oficina/VPN (opcional)
$officeIPs = @("203.0.113.10", "198.51.100.0/24")
foreach ($ip in $officeIPs) {
    Add-AzStorageAccountNetworkRule `
        -ResourceGroupName "myRG" `
        -Name "mystorageaccount" `
        -IPAddressOrRange $ip
}

# Firewall: Permite conexión al endpoint (todos los servicios)
Add-AzStorageAccountNetworkRule -ResourceId $resourceId

# RBAC: Controla acceso específico por servicio
New-AzRoleAssignment `
    -ObjectId $principalId `
    -RoleDefinitionName "Storage Blob Data Contributor" `  # Solo Blob
    -Scope $storageAccountScope

# No asignas roles para Files, Queues o Tables
# → Aunque el firewall permita conexión, no tiene permisos RBAC

function Test-StorageAccountSecurityConfig {
    param(
        [string]$ResourceGroupName,
        [string]$StorageAccountName
    )

    $rules = Get-AzStorageAccountNetworkRuleSet `
        -ResourceGroupName $ResourceGroupName `
        -Name $StorageAccountName

    Write-Host "`n🔍 VALIDACIÓN DE CONFIGURACIÓN ÓPTIMA" -ForegroundColor Cyan
    Write-Host "═══════════════════════════════════════`n" -ForegroundColor Cyan

    $score = 0
    $maxScore = 5

    # Check 1: DefaultAction
    if ($rules.DefaultAction -eq "Deny") {
        Write-Host "✅ DefaultAction: Deny (Correcto)" -ForegroundColor Green
        $score++
    } else {
        Write-Host "❌ DefaultAction: Allow (Cambiar a Deny)" -ForegroundColor Red
    }

    # Check 2: Bypass óptimo
    if ($rules.Bypass -notlike "*AzureServices*" -and 
        $rules.Bypass -like "*Logging*" -and 
        $rules.Bypass -like "*Metrics*") {
        Write-Host "✅ Bypass: Logging,Metrics (Óptimo)" -ForegroundColor Green
        $score++
    } elseif ($rules.Bypass -like "*AzureServices*") {
        Write-Host "⚠️  Bypass incluye AzureServices (Considerar usar Resource Instances)" -ForegroundColor Yellow
    }

    # Check 3: Resource Instances
    if ($rules.ResourceAccessRules.Count -gt 0) {
        Write-Host "✅ Resource Instances: $($rules.ResourceAccessRules.Count) configuradas" -ForegroundColor Green
        foreach ($rule in $rules.ResourceAccessRules) {
            $resourceName = $rule.ResourceId.Split('/')[-1]
            Write-Host "   → $resourceName" -ForegroundColor Gray
        }
        $score++
    } else {
        Write-Host "⚠️  No hay Resource Instances configuradas" -ForegroundColor Yellow
    }

    # Check 4: VNet Rules
    if ($rules.VirtualNetworkRules.Count -gt 0) {
        Write-Host "✅ VNet Rules: $($rules.VirtualNetworkRules.Count)" -ForegroundColor Green
        $score++
    }

    # Check 5: IP Rules
    if ($rules.IpRules.Count -gt 0) {
        Write-Host "✅ IP Rules: $($rules.IpRules.Count)" -ForegroundColor Green
        $score++
    }

    # Resumen
    Write-Host "`n════════════════════════════════════════" -ForegroundColor Cyan
    Write-Host "Puntaje de Seguridad: $score/$maxScore" -ForegroundColor $(
        if ($score -eq $maxScore) { "Green" } 
        elseif ($score -ge 3) { "Yellow" } 
        else { "Red" }
    )

    if ($score -ge 4 -and $rules.Bypass -notlike "*AzureServices*") {
        Write-Host "🎉 CONFIGURACIÓN ÓPTIMA" -ForegroundColor Green
    } else {
        Write-Host "⚠️  Revisar configuración según recomendaciones" -ForegroundColor Yellow
    }
}

# Uso
Test-StorageAccountSecurityConfig -ResourceGroupName "myRG" -StorageAccountName "mystorageaccount"

# Escenario: Necesitas Azure Backup + Synapse + Data Factory

$rgName = "myResourceGroup"
$storageAccount = "mystorageaccount"
$tenantId = "your-tenant-id"

# 1. Configurar con Trusted Services (requerido para Azure Backup)
Update-AzStorageAccountNetworkRuleSet `
    -ResourceGroupName $rgName `
    -Name $storageAccount `
    -DefaultAction Deny `
    -Bypass AzureServices,Logging,Metrics

Write-Host "✅ Trusted Services habilitado (Azure Backup)" -ForegroundColor Yellow

# 2. Agregar Resource Instances para control granular de otros servicios
# Aunque Trusted Services está habilitado, esto añade trazabilidad
$resources = @(
    "/subscriptions/xxx/resourceGroups/rg1/providers/Microsoft.Synapse/workspaces/prod-synapse",
    "/subscriptions/xxx/resourceGroups/rg1/providers/Microsoft.DataFactory/factories/prod-adf"
)

foreach ($resourceId in $resources) {
    Add-AzStorageAccountNetworkRule `
        -ResourceGroupName $rgName `
        -Name $storageAccount `
        -TenantId $tenantId `
        -ResourceId $resourceId

    Write-Host "✅ Resource Instance agregada: $($resourceId.Split('/')[-1])" -ForegroundColor Green
}

# 3. Documentar en tags
$tags = @{
    "FirewallConfig" = "TrustedServices+ResourceInstances"
    "TrustedServicesReason" = "Azure Backup - Unmanaged Disks"
    "MigrationPlan" = "Move to Managed Disks by Q2-2026"
}

Update-AzStorageAccount `
    -ResourceGroupName $rgName `
    -Name $storageAccount `
    -Tag $tags

Write-Host "✅ Configuración documentada en tags" -ForegroundColor Green

$ctx = New-AzStorageContext -StorageAccountName "sa" -UseConnectedAccount

# Probar Blob
try {
    Get-AzStorageContainer -Context $ctx -MaxCount 1
    Write-Host "✅ Blob: Accesible"
} catch {
    Write-Host "❌ Blob: $($_.Exception.Message)"
}

# Probar Queue
try {
    Get-AzStorageQueue -Context $ctx | Select-Object -First 1
    Write-Host "✅ Queue: Accesible"
} catch {
    Write-Host "❌ Queue: $($_.Exception.Message)"
}