# Create a Linux VM
az vm create \
  --resource-group MyRG \
  --name MyVM \
  --image UbuntuLTS \
  --admin-username azureuser \
  --generate-ssh-keys \
  --size Standard_B2s

# Open port 80 for web traffic
az vm open-port --resource-group MyRG --name MyVM --port 80

# Create App Service Plan
az appservice plan create \
  --name MyPlan --resource-group MyRG \
  --sku B1 --is-linux

# Create web app
az webapp create \
  --name myapi-prod \
  --resource-group MyRG \
  --plan MyPlan \
  --runtime "NODE|18-lts"

# Deploy from local git
az webapp deployment source config-local-git \
  --name myapi-prod --resource-group MyRG

import azure.functions as func
import logging

# HTTP Trigger — becomes a REST endpoint
@app.route(route="predict", methods=["POST"])
def predict(req: func.HttpRequest) -> func.HttpResponse:
    data = req.get_json()
    result = ml_model.predict(data['features'])
    return func.HttpResponse(json.dumps({'prediction': result}))

# Timer Trigger — runs every day at 9am UTC
@app.timer_trigger(schedule="0 0 9 * * *")
def daily_report(timer: func.TimerRequest):
    logging.info('Running daily report...')
    generate_report_and_email()

from azure.storage.blob import BlobServiceClient

client = BlobServiceClient.from_connection_string(conn_str)
container = client.get_container_client("ml-datasets")

# Upload a file (e.g., CSV dataset)
with open("dataset.csv", "rb") as f:
    container.upload_blob("data/dataset.csv", f, overwrite=True)

# Download it
blob = container.get_blob_client("data/dataset.csv")
data = blob.download_blob().readall()

# Generate a temporary shareable URL (SAS Token)
from azure.storage.blob import generate_blob_sas, BlobSasPermissions
from datetime import datetime, timedelta
sas = generate_blob_sas(account_name, container_name, blob_name,
    account_key=key, permission=BlobSasPermissions(read=True),
    expiry=datetime.utcnow() + timedelta(hours=1))
url = f"https://{account_name}.blob.core.windows.net/{container_name}/{blob_name}?{sas}"

az storage account create \
  --name mystorageaccount \
  --resource-group MyRG \
  --location eastus \
  --sku Standard_LRS \    # Locally Redundant = 3 copies in 1 datacenter
  --kind StorageV2        # Latest version, supports all 4 types

# Redundancy options:
# LRS — 3 copies, same datacenter (cheapest)
# ZRS — 3 copies across 3 Availability Zones (same region)
# GRS — LRS + copies in paired region (disaster recovery)

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

# No password, connection string, or API key anywhere in code!
# The VM/Function/App Service has an identity, Azure validates it
credential = DefaultAzureCredential()

# Access Key Vault using managed identity
kv_client = SecretClient(
    vault_url="https://myvault.vault.azure.net",
    credential=credential
)
secret = kv_client.get_secret("db-connection-string")
print(secret.value)  # Got it without any hardcoded credentials!

# Give a user "Reader" access to a resource group
az role assignment create \
  --assignee [email protected] \
  --role Reader \
  --resource-group MyRG

# Give a Function App's managed identity access to Key Vault
az role assignment create \
  --assignee {managed-identity-object-id} \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vault}

# 1. Store a secret via CLI
az keyvault secret set \
  --vault-name myapp-vault \
  --name "openai-api-key" \
  --value "sk-xxxxxxxxxxxxxxxx"

# 2. Give your app's managed identity access
az keyvault set-policy \
  --name myapp-vault \
  --object-id {app-managed-identity-id} \
  --secret-permissions get list

# 3. App reads secret at runtime — Python
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()
client = SecretClient("https://myapp-vault.vault.azure.net", credential)

openai_key = client.get_secret("openai-api-key").value
# Use it — never stored in code or environment variables!

# App Service: reference Key Vault in app settings
# @Microsoft.KeyVault(SecretUri=https://vault.azure.net/secrets/name/version)

import redis
r = redis.from_url(os.getenv("REDIS_URL"))

def get_user(user_id: str):
    # 1. Check cache first
    cached = r.get(f"user:{user_id}")
    if cached:
        return json.loads(cached)

    # 2. Cache miss — fetch from DB
    user = db.query("SELECT * FROM users WHERE id=?", user_id)

    # 3. Store in cache for 5 minutes
    r.setex(f"user:{user_id}", 300, json.dumps(user))
    return user

from openai import AzureOpenAI

client = AzureOpenAI(
    azure_endpoint="https://myapp.openai.azure.com",
    api_key=os.getenv("AZURE_OPENAI_KEY"),  # or Managed Identity!
    api_version="2024-02-01"
)

response = client.chat.completions.create(
    model="gpt-4",  # your deployment name
    messages=[
        {"role": "system", "content": "You are a helpful assistant."},
        {"role": "user", "content": "Explain machine learning simply."}
    ]
)
print(response.choices[0].message.content)

trigger:
  branches:
    include: [main]

stages:
- stage: Build
  jobs:
  - job: BuildAngular
    steps:
    - task: NodeTool@0
      inputs: { versionSpec: '18.x' }
    - script: |
        npm ci
        npm run build -- --configuration production
    - publish: dist/my-app
      artifact: angular-build

  - job: BuildPythonAPI
    steps:
    - script: pip install -r requirements.txt
    - script: pytest tests/ -v
    - script: docker build -t myapi:$(Build.BuildId) .

- stage: Deploy
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeployToProduction
    environment: production
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureWebApp@1
            inputs:
              azureSubscription: 'MyAzureConnection'
              appName: 'myapp-api'
              package: '$(Pipeline.Workspace)/drop/*.zip'

// Top 10 most common errors in last 24h
exceptions
| where timestamp > ago(24h)
| summarize count() by outerMessage
| order by count_ desc
| take 10

// Average API response time by endpoint
requests
| where timestamp > ago(1h)
| summarize avg(duration) by name
| order by avg_duration desc

// Find slow SQL queries
dependencies
| where type == "SQL" and duration > 1000
| project timestamp, name, duration, data