# 连接 Azure
Connect-AzAccount -Subscription 'production-subscription'

# --- 检索常用内置策略定义 ---
# 查找与"允许位置"相关的内置策略
$builtInPolicies = Get-AzPolicyDefinition | Where-Object {
    $_.DisplayName -like '*allowed locations*' -or
    $_.DisplayName -like '*允许的位置*'
} | Select-Object -First 5 DisplayName, PolicyType, Name

Write-Host '=== 内置策略：允许的位置 ===' -ForegroundColor Cyan
$builtInPolicies | Format-Table -AutoSize

# 查找与"强制标记"相关的内置策略
$tagPolicies = Get-AzPolicyDefinition | Where-Object {
    $_.DisplayName -like '*tag*' -and $_.PolicyType -eq 'BuiltIn'
} | Select-Object -First 5 DisplayName, Name

Write-Host '=== 内置策略：标记相关 ===' -ForegroundColor Cyan
$tagPolicies | Format-Table -AutoSize

# --- 创建自定义策略定义：禁止创建未标记成本中心的资源 ---
$policyRule = @{
    if = @{
        allOf = @(
            @{
                field = 'type'
                notLike = 'Microsoft.Resources/*'
            }
            @{
                field = '[concat(''tags'', ''.'', ''CostCenter'')]'
                exists = 'false'
            }
        )
    }
    then = @{
        effect = 'deny'
    }
}

$policyParameters = @{
    tagName = @{
        type = 'String'
        metadata = @{
            displayName = '标记名称'
            description = '要求必须存在的标记名称'
        }
    }
}

# 使用参数化的方式构建策略规则
$parameterizedRule = @{
    if = @{
        allOf = @(
            @{
                field = 'type'
                notLike = 'Microsoft.Resources/*'
            }
            @{
                field = "[concat('tags', '.', parameters('tagName'))]"
                exists = 'false'
            }
        )
    }
    then = @{
        effect = 'deny'
    }
}

$customPolicy = New-AzPolicyDefinition `
    -Name 'require-mandatory-tag' `
    -DisplayName '要求资源必须包含指定标记' `
    -Description '拒绝创建未包含指定标记的资源，确保成本分摊和资源归属可追溯' `
    -Policy $parameterizedRule `
    -Parameter $policyParameters `
    -Mode 'Indexed'

Write-Host "自定义策略已创建: $($customPolicy.Name)" -ForegroundColor Green

# --- 创建策略集（Initiative）将多个策略打包管理 ---
$initiativeDefinition = @{
    name       = 'cost-governance-initiative'
    displayName = '成本治理策略集'
    description = '统一管理所有与成本控制相关的策略，包括标记、SKU 限制和区域约束'
    policyDefinitions = @(
        @{
            policyDefinitionId = $customPolicy.Id
            parameters = @{
                tagName = @{ value = 'CostCenter' }
            }
        }
    )
}

# 获取内置的"允许位置"策略
$locationPolicy = Get-AzPolicyDefinition |
    Where-Object { $_.Name -eq 'e56962a6-4747-49cd-b67b-bf8b01975c4c' }

if ($locationPolicy) {
    $initiativeDefinition.policyDefinitions += @{
        policyDefinitionId = $locationPolicy.Id
        parameters = @{
            listOfAllowedLocations = @{
                value = @('eastasia', 'southeastasia', 'eastus', 'westus2')
            }
        }
    }
}

$initiative = New-AzPolicySetDefinition `
    -Name $initiativeDefinition.name `
    -DisplayName $initiativeDefinition.displayName `
    -Description $initiativeDefinition.description `
    -PolicyDefinition ($initiativeDefinition.policyDefinitions | ConvertTo-Json -Depth 5)

Write-Host "策略集已创建: $($initiative.Name)" -ForegroundColor Green

# --- 订阅级策略分配 ---
$subscriptionId = (Get-AzContext).Subscription.Id
$scope = "/subscriptions/$subscriptionId"

# 获取之前创建的策略集
$initiative = Get-AzPolicySetDefinition -Name 'cost-governance-initiative'

# 创建订阅级策略分配
$assignment = New-AzPolicyAssignment `
    -Name 'cost-governance-sub' `
    -DisplayName '订阅级成本治理策略' `
    -Scope $scope `
    -PolicySetDefinition $initiative `
    -Description '在此订阅中强制执行标记要求和区域限制'

Write-Host "订阅级策略分配已创建: $($assignment.Name)" -ForegroundColor Green

# --- 资源组级策略分配（更精细的控制） ---
$rgScope = "$scope/resourceGroups/rg-production"
$skuPolicy = Get-AzPolicyDefinition |
    Where-Object { $_.DisplayName -like '*allowed resource types*' } |
    Select-Object -First 1

# 为生产环境资源组分配更严格的策略
$rgAssignment = New-AzPolicyAssignment `
    -Name 'production-sku-restriction' `
    -DisplayName '生产环境 SKU 限制' `
    -Scope $rgScope `
    -PolicyDefinition $skuPolicy `
    -Description '限制生产环境只允许创建特定资源类型'

Write-Host "资源组级策略分配已创建: $($rgAssignment.Name)" -ForegroundColor Green

# --- 管理组级批量分配（跨订阅统一治理） ---
$mgScope = '/providers/Microsoft.Management/managementGroups/mg-enterprise'

# 获取管理组下的所有订阅
$mgSubscriptions = Get-AzManagementGroupSubscription `
    -GroupName 'mg-enterprise' -Expand

Write-Host "管理组下的订阅数量: $($mgSubscriptions.Count)"

# 为管理组分配策略集，所有子订阅自动继承
$mgAssignment = New-AzPolicyAssignment `
    -Name 'enterprise-governance' `
    -DisplayName '企业级合规治理策略' `
    -Scope $mgScope `
    -PolicySetDefinition $initiative `
    -EnforcementMode 'Default'

Write-Host "管理组级策略分配已创建（子订阅将自动继承）" -ForegroundColor Green

# --- 配置策略豁免 ---
# 对特定资源（如测试环境）豁免标记策略
$exemptionScope = "$scope/resourceGroups/rg-sandbox"
$waiverAssignment = Get-AzPolicyAssignment -Name 'cost-governance-sub'

# 创建策略豁免
$exemption = New-AzPolicyExemption `
    -Name 'sandbox-tag-exemption' `
    -DisplayName '沙盒环境标记豁免' `
    -Scope $exemptionScope `
    -PolicyAssignment $waiverAssignment `
    -ExemptionCategory 'Waiver' `
    -ExpiresOn (Get-Date).AddMonths(6) `
    -Description '沙盒环境暂不强制标记要求，6个月后重新评估'

Write-Host "策略豁免已创建，有效期至: $($exemption.Properties.ExpiresOn)" -ForegroundColor Green

# --- 查看所有策略分配 ---
$allAssignments = Get-AzPolicyAssignment | Where-Object {
    $_.Scope -like "*$subscriptionId*"
} | Select-Object DisplayName, Scope, EnforcementMode

Write-Host "`n=== 当前订阅下的策略分配 ===" -ForegroundColor Cyan
$allAssignments | Format-Table -AutoSize

# --- 查询合规状态 ---
$subscriptionId = (Get-AzContext).Subscription.Id
$scope = "/subscriptions/$subscriptionId"

# 获取所有策略分配的合规状态摘要
$complianceStates = Get-AzPolicyState | Where-Object {
    $_.ResourceLocation -and $_.PolicyAssignmentName
} | Group-Object PolicyAssignmentName, ComplianceState | ForEach-Object {
    [PSCustomObject]@{
        PolicyAssignment = $_.Values[0]
        ComplianceState  = $_.Values[1]
        ResourceCount    = $_.Count
    }
}

Write-Host '=== 合规状态摘要 ===' -ForegroundColor Cyan
$complianceStates | Sort-Object PolicyAssignment, ComplianceState |
    Format-Table -AutoSize

# 查询不合规资源的详细信息
$nonCompliant = Get-AzPolicyState | Where-Object {
    $_.ComplianceState -eq 'NonCompliant'
} | Select-Object -First 20 `
    ResourceId, ResourceType, ResourceLocation,
    PolicyDefinitionName, PolicyAssignmentName,
    Timestamp

Write-Host "`n=== 不合规资源（前 20 条）===" -ForegroundColor Yellow
$nonCompliant | Format-Table -AutoSize

# --- 创建自动修复任务 ---
# 获取需要修复的策略分配
$tagAssignment = Get-AzPolicyAssignment -Name 'cost-governance-sub'

# 创建修复任务：为缺少标记的资源自动添加默认标记值
$remediationTask = Start-AzPolicyRemediation `
    -Name 'remediate-missing-tags' `
    -PolicyAssignmentId $tagAssignment.PolicyAssignmentId `
    -ResourceDiscoveryMode 'ExistingNonCompliant' `
    -Description '为所有缺少 CostCenter 标记的资源添加默认值'

Write-Host "修复任务已启动: $($remediationTask.Name)" -ForegroundColor Green
Write-Host "待修复资源数: $($remediationTask.ProvisioningState)"

# 轮询修复任务状态
$taskName = $remediationTask.Name
$maxRetries = 12
$retryCount = 0

while ($retryCount -lt $maxRetries) {
    Start-Sleep -Seconds 30
    $task = Get-AzPolicyRemediation -Name $taskName `
        -Scope $scope -ErrorAction SilentlyContinue

    if ($task -and $task.ProvisioningState -eq 'Succeeded') {
        Write-Host "修复任务完成" -ForegroundColor Green
        break
    }

    $retryCount++
    Write-Host "等待修复任务完成... ($retryCount/$maxRetries)"
}

# --- 生成合规趋势报告 ---
function Get-ComplianceTrend {
    param(
        [string]$Scope,
        [int]$Days = 30
    )

    $startDate = (Get-Date).AddDays(-$Days)
    $trend = @()

    for ($day = 0; $day -lt $Days; $day += 7) {
        $checkDate = $startDate.AddDays($day)
        $dateLabel = $checkDate.ToString('yyyy-MM-dd')

        # 获取该时间段的合规统计
        $states = Get-AzPolicyState | Where-Object {
            $_.Timestamp -ge $checkDate -and
            $_.Timestamp -lt $checkDate.AddDays(7)
        }

        $total = ($states | Measure-Object).Count
        $compliant = ($states | Where-Object {
            $_.ComplianceState -eq 'Compliant'
        } | Measure-Object).Count

        $complianceRate = if ($total -gt 0) {
            [math]::Round(($compliant / $total) * 100, 1)
        } else {
            0
        }

        $trend += [PSCustomObject]@{
            Week         = $dateLabel
            TotalResources = $total
            Compliant    = $compliant
            NonCompliant = $total - $compliant
            Rate         = "$complianceRate%"
        }
    }

    return $trend
}

# 生成最近 30 天的合规趋势
$trendReport = Get-ComplianceTrend -Scope $scope -Days 30

Write-Host "`n=== 合规趋势报告（最近 30 天）===" -ForegroundColor Cyan
$trendReport | Format-Table -AutoSize

# 计算总体合规率
$latestWeek = $trendReport | Select-Object -Last 1
Write-Host "`n最新一周合规率: $($latestWeek.Rate)" -ForegroundColor Green

# 连接 Azure 账户（如已登录可跳过）
Connect-AzAccount

# 搜索与"标签"相关的内置策略定义
$tagPolicies = Get-AzPolicyDefinition | Where-Object {
    $_.Properties.DisplayName -match "tag" -and
    $_.Properties.PolicyType -eq "BuiltIn"
}

# 输出策略名称和显示名
foreach ($policy in $tagPolicies) {
    [PSCustomObject]@{
        Name        = $policy.Name
        DisplayName = $policy.Properties.DisplayName
        Category    = $policy.Properties.Metadata.category
    }
}

# 获取目标资源组信息
$rg = Get-AzResourceGroup -Name "prod-app-rg"

# 获取内置策略定义（要求资源必须带有指定标签）
$policyDef = Get-AzPolicyDefinition | Where-Object {
    $_.Properties.DisplayName -eq "Require a tag on resources"
} | Select-Object -First 1

# 构造策略参数：指定必须存在的标签名为 "Environment"
$policyParam = @{
    tagName = "Environment"
}

# 分配策略到资源组
$assignment = New-AzPolicyAssignment `
    -Name "require-env-tag" `
    -DisplayName "要求所有资源带有 Environment 标签" `
    -PolicyDefinition $policyDef `
    -Scope $rg.ResourceId `
    -PolicyParameterObject $policyParam

Write-Host "策略已分配，AssignmentId: $($assignment.PolicyAssignmentId)"

# 获取当前订阅 ID
$subscriptionId = (Get-AzContext).Subscription.Id

# 查询最近一次策略评估的合规状态
$complianceStates = Get-AzPolicyState | Where-Object {
    $_.ComplianceState -eq "NonCompliant"
}

# 按策略分配分组统计不合规资源数量
$summary = @{}
foreach ($state in $complianceStates) {
    $key = $state.PolicyAssignmentName
    if (-not $summary.ContainsKey($key)) {
        $summary[$key] = 0
    }
    $summary[$key]++
}

foreach ($item in $summary.GetEnumerator() | Sort-Object Value -Descending) {
    [PSCustomObject]@{
        PolicyAssignment = $item.Key
        NonCompliantCount = $item.Value
    }
}

# 定义输出路径
$reportDate = Get-Date -Format "yyyyMMdd"
$csvPath = "$HOME/AzurePolicyReport_$reportDate.csv"

# 获取所有不合规状态记录
$nonCompliant = Get-AzPolicyState | Where-Object {
    $_.ComplianceState -eq "NonCompliant"
}

# 构造报告对象
$reportRows = foreach ($record in $nonCompliant) {
    [PSCustomObject]@{
        Timestamp          = $record.Timestamp
        ResourceId         = $record.ResourceId
        ResourceType       = $record.ResourceType
        ResourceGroup      = $record.ResourceGroup
        PolicyAssignment   = $record.PolicyAssignmentName
        PolicyDefinition   = $record.PolicyDefinitionName
        ComplianceState    = $record.ComplianceState
    }
}

# 导出为 CSV
$reportRows | Export-Csv -Path $csvPath -NoTypeInformation -Encoding UTF8

Write-Host "合规报告已导出: $csvPath"
Write-Host "共 $($reportRows.Count) 条不合规记录"