Azure Cost Analysis Ingeschakeld

<# ================================================================================ AZURE POWERSHELL SCRIPT - Nederlandse Baseline voor Veilige Cloud ================================================================================ .SYNOPSIS Azure Cost Analysis Enabled .DESCRIPTION Controleert of Azure Cost Analysis beschikbaar is en correct wordt gebruikt. .NOTES Filename: cost-analysis-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 Related JSON: content/azure/cost-management/cost-analysis-enabled.json #> #Requires -Version 5.1 #Requires -Modules Az.Accounts, Az.CostManagement [CmdletBinding()] param( [Parameter()] [switch]$Monitoring, [Parameter()] [switch]$Remediation, [Parameter()] [switch]$Revert, [Parameter()] [switch]$WhatIf ) $ErrorActionPreference = 'Stop' $script:PolicyName = "Azure Cost Analysis Enabled" # ============================================================================ # FUNCTIONS # ============================================================================ function Connect-RequiredServices { <# .SYNOPSIS Maakt verbinding met benodigde Azure-services #> try { if (-not (Get-AzContext)) { Write-Host "Verbinden met Azure..." -ForegroundColor Cyan Connect-AzAccount | Out-Null } $context = Get-AzContext Write-Host "Verbonden met: $($context.Account.Id) - Subscription: $($context.Subscription.Name)" -ForegroundColor Green } catch { Write-Error "Kan geen verbinding maken met Azure: $_" throw } } function Test-CostAnalysisAccess { <# .SYNOPSIS Test of Cost Analysis toegankelijk is #> try { $subscriptions = Get-AzSubscription -ErrorAction SilentlyContinue if (-not $subscriptions) { return @{ IsCompliant = $false Message = "Geen abonnementen gevonden of geen toegang" } } $accessibleSubscriptions = 0 foreach ($sub in $subscriptions) { Set-AzContext -SubscriptionId $sub.Id | Out-Null try { # Test of Cost Management API toegankelijk is $query = @{ type = "ActualCost" timeframe = "TheLastMonth" dataset = @{ granularity = "Monthly" aggregation = @{ totalCost = @{ name = "PreTaxCost" function = "Sum" } } } } $result = Invoke-AzRestMethod -Path "/subscriptions/$($sub.Id)/providers/Microsoft.CostManagement/query?api-version=2023-03-01" -Method POST -Payload ($query | ConvertTo-Json -Depth 10) -ErrorAction SilentlyContinue if ($result.StatusCode -eq 200) { $accessibleSubscriptions++ } } catch { # API kan beperkt zijn, maar Cost Analysis in portal is altijd beschikbaar # We beschouwen dit als compliant als er abonnementen zijn } } return @{ IsCompliant = $true TotalSubscriptions = $subscriptions.Count AccessibleSubscriptions = $accessibleSubscriptions Message = "Cost Analysis is beschikbaar voor $($subscriptions.Count) abonnement(en)" } } catch { return @{ IsCompliant = $false Message = "Fout bij testen van Cost Analysis toegang: $_" } } } function Get-CostAnalysisPermissions { <# .SYNOPSIS Controleert of gebruikers de juiste rechten hebben #> try { $subscriptions = Get-AzSubscription -ErrorAction SilentlyContinue $results = @() foreach ($sub in $subscriptions) { Set-AzContext -SubscriptionId $sub.Id | Out-Null try { # Check voor Cost Management Reader rol $roleAssignments = Get-AzRoleAssignment -Scope "/subscriptions/$($sub.Id)" -ErrorAction SilentlyContinue | Where-Object { $_.RoleDefinitionName -in @("Cost Management Reader", "Cost Management Contributor", "Owner", "Contributor") } $results += @{ SubscriptionName = $sub.Name SubscriptionId = $sub.Id HasAccess = ($roleAssignments.Count -gt 0) RoleAssignments = $roleAssignments.Count } } catch { $results += @{ SubscriptionName = $sub.Name SubscriptionId = $sub.Id HasAccess = $false Error = $_.Exception.Message } } } return $results } catch { Write-Warning "Kan rechten niet controleren: $_" return @() } } # ============================================================================ # STANDARD FUNCTIONS # ============================================================================ function Invoke-Implementation { <# .SYNOPSIS Implementeert de configuratie #> [CmdletBinding()] param() Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$script:PolicyName - Implementatie" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Invoke-Remediation } function Invoke-Monitoring { <# .SYNOPSIS Controleert de huidige configuratie status #> [CmdletBinding()] param() Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$script:PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan try { Connect-RequiredServices # Test Cost Analysis toegang $accessTest = Test-CostAnalysisAccess Write-Host "`nToegang tot Cost Analysis:" -ForegroundColor Yellow Write-Host " Status: $($accessTest.Message)" -ForegroundColor $(if ($accessTest.IsCompliant) { "Green" } else { "Yellow" }) if ($accessTest.TotalSubscriptions) { Write-Host " Abonnementen: $($accessTest.TotalSubscriptions)" -ForegroundColor Cyan } # Check permissions Write-Host "`nRechten controle:" -ForegroundColor Yellow $permissions = Get-CostAnalysisPermissions if ($permissions.Count -gt 0) { foreach ($perm in $permissions) { $status = if ($perm.HasAccess) { "OK" } else { "Waarschuwing" } $color = if ($perm.HasAccess) { "Green" } else { "Yellow" } Write-Host " $($perm.SubscriptionName): $status" -ForegroundColor $color if ($perm.RoleAssignments) { Write-Host " Roltoewijzingen: $($perm.RoleAssignments)" -ForegroundColor Gray } } } # Instructions Write-Host "`nAzure Cost Analysis is automatisch beschikbaar voor alle abonnementen." -ForegroundColor Cyan Write-Host "`nAanbevolen acties:" -ForegroundColor Yellow Write-Host " 1. Open Azure Portal > Cost Management + Billing > Cost analysis" -ForegroundColor Gray Write-Host " 2. Configureer aangepaste weergaven voor veelgebruikte analyses" -ForegroundColor Gray Write-Host " 3. Zorg voor consistente tagstructuur voor kostenallocatie" -ForegroundColor Gray Write-Host " 4. Voer wekelijkse kostenreviews uit" -ForegroundColor Gray Write-Host " 5. Controleer of gebruikers de rol Cost Management Reader hebben" -ForegroundColor Gray if ($accessTest.IsCompliant) { Write-Host "`nSTATUS: COMPLIANT" -ForegroundColor Green Write-Host "Cost Analysis is beschikbaar en toegankelijk." -ForegroundColor Green exit 0 } else { Write-Host "`nSTATUS: WAARSCHUWING" -ForegroundColor Yellow Write-Host "Controleer toegangsrechten en abonnementconfiguratie." -ForegroundColor Yellow exit 1 } } catch { Write-Host "`nERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat #> [CmdletBinding()] param() Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$script:PolicyName - Remediatie" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan try { Connect-RequiredServices Write-Host "`nAzure Cost Analysis is automatisch beschikbaar." -ForegroundColor Cyan Write-Host "Geen technische configuratie vereist." -ForegroundColor Cyan Write-Host "`nAanbevolen stappen voor effectief gebruik:" -ForegroundColor Yellow Write-Host " 1. Verifieer toegangsrechten:" -ForegroundColor Gray Write-Host " - Gebruikers hebben rol 'Cost Management Reader' nodig" -ForegroundColor Gray Write-Host " - Voor exports: rol 'Cost Management Contributor' of hoger" -ForegroundColor Gray Write-Host "`n 2. Configureer in Azure Portal:" -ForegroundColor Gray Write-Host " - Navigeer naar: Cost Management + Billing > Cost analysis" -ForegroundColor Gray Write-Host " - Maak aangepaste weergaven aan voor veelgebruikte analyses" -ForegroundColor Gray Write-Host " - Configureer filters op service, resourcegroep, tags" -ForegroundColor Gray Write-Host "`n 3. Tagstructuur:" -ForegroundColor Gray Write-Host " - Ontwikkel consistente tagstructuur (afdeling, project, kostenplaats)" -ForegroundColor Gray Write-Host " - Pas tags toe op alle resources voor kostenallocatie" -ForegroundColor Gray Write-Host " - Overweeg Azure Policy voor automatische tagtoepassing" -ForegroundColor Gray Write-Host "`n 4. Processen:" -ForegroundColor Gray Write-Host " - Voer wekelijkse kostenreviews uit" -ForegroundColor Gray Write-Host " - Monitor kostenprognoses en trends" -ForegroundColor Gray Write-Host " - Onderzoek anomalieën direct" -ForegroundColor Gray Write-Host "`nRemediatie voltooid. Gebruik -Monitoring om status te controleren." -ForegroundColor Green exit 0 } catch { Write-Host "`nERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { <# .SYNOPSIS Keert de configuratie terug #> [CmdletBinding()] param() Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$script:PolicyName - Revert" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "`nCost Analysis kan niet worden uitgeschakeld." -ForegroundColor Yellow Write-Host "De functionaliteit is altijd beschikbaar in Azure Portal." -ForegroundColor Yellow Write-Host "`nOm toegang te beperken:" -ForegroundColor Cyan Write-Host " - Verwijder Cost Management Reader/Contributor rollen" -ForegroundColor Gray Write-Host " - Beperk toegang tot specifieke abonnementen" -ForegroundColor Gray exit 0 } # ============================================================================ # MAIN EXECUTION # ============================================================================ try { if ($Revert) { Invoke-Revert } elseif ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "`nGebruik: -Monitoring | -Remediation | -Revert" -ForegroundColor Yellow Write-Host "`nVoorbeelden:" -ForegroundColor Cyan Write-Host " .\cost-analysis-enabled.ps1 -Monitoring" -ForegroundColor Gray Write-Host " .\cost-analysis-enabled.ps1 -Remediation" -ForegroundColor Gray } } catch { Write-Host "`nFATAL ERROR: $_" -ForegroundColor Red exit 2 } finally { Write-Host "`n========================================" -ForegroundColor Cyan }