\n\nThis page has been machine-translated from the original page.
\n
The other day I summarized the steps for building a honeypot on Azure in this article, but when you actually operate it, the thing you worry about is cost.
\nThis time I would like to configure Azure cost alerts so that notifications are sent before the operation goes over budget.
\n\nWhen I looked into Azure cost alerts, it seemed that the following three types existed.
\n\nReference: Monitor usage and spending with cost alerts in Azure Cost Management | Microsoft Docs
\nA “budget alert” is an alert that occurs when the configured budget threshold is reached or exceeded.
\nThis “budget alert” supports the following two conditions.
\nBoth the “credit alert” and the “department spending quota alert” are alerts for corporate organizations, so this time I will use the “budget alert”.
\nFollowing the documentation below, I will configure a “budget alert” from the Azure portal.
\nReference: Tutorial - Create and manage Azure budgets | Microsoft Docs
\nBefore actually creating the alert, I decided to create an action group so I can control the notification destinations.
\nAzure action groups can manage notification settings.
\nReference: Create and manage action groups in the Azure portal - Azure Monitor | Microsoft Docs
\nThis time I created an action group that sends SMS, email notifications, and notifications to the Azure app.
\nWhen you create the budget alert, configure it to trigger this action group and the budget alert notification will be sent.
\nAction groups can also be used for notifications other than budget alerts.
\nThis is also an optional setting, but you can additionally define actions to run when the action group is triggered.
\nThat means you can also perform arbitrary processing by using Function and so on.
\nNext, create a new budget alert from “Cost alerts” on the subscription page.
\nFor the alert conditions, you can set forecasted and actual values as percentages of the budget.
\nThis time I configured warnings like the following, including an alert when the forecasted usage exceeded 90%.
\nThat completes the cost alert notification settings.
\nIf you get good enough with the Azure API and the like, it might even be possible to automate something like stopping all resources when an alert is sent from the action group.
\n“Azure Function” (called “Function App” in the Japanese UI) is a service that can run applications in a serverless way.
\nReference: Azure Functions documentation | Microsoft Docs
\nCreate a new Function from “Function App”.
\nI set the runtime to Python.
\nAzure Function is developed from localhost by using VSCode or any editor you like.
\nUnlike AWS Lambda, it does not look like editing from a web editor is possible.
\nNext, run the following command on localhost (Windows) to install the Core Tools.
\nnpm install -g azure-functions-core-tools@3 --unsafe-perm trueEven in an environment where Node is not installed, it can be installed by following the steps in the documentation below.
\nReference: Work with Azure Functions Core Tools | Microsoft Docs
\nNext, since I was developing in VSCode this time, I installed the following VSCode extension.
\nOnce the extension has been installed, select Signin to Azure and log in to Azure from VSCode.
Then your subscription will appear in VSCode, and the Function you created earlier will also appear.
\nNext, create a local Function from the [Create Function] button in VSCode.
\nI chose the trigger “HTTP Trigger”.
\nLooking at the Function App created locally, you can see that a simple template has been generated in a file named __init__.py.
So I decided to tweak the template’s main function a little.
What it does is simple: when the Function is called, it just sends a message to Discord’s webhook by using urllib.request.
import json\nimport logging\nfrom urllib import request, parse\n\nimport azure.functions as func\n\nDISCORDWEBHOOK = \"<Webhook URL>\"\ndata = {\n \"content\": \"Azure Cost Alert\"\n}\nheaders = {\n \"User-Agent\": \"curl/7.64.1\",\n \"Content-Type\": \"application/json\",\n}\n\ndef main(req: func.HttpRequest) -> func.HttpResponse:\n logging.info('Python HTTP trigger function processed a request.')\n\n # Post to Discord\n parse.urlencode(data).encode()\n req = request.Request(\n url = DISCORDWEBHOOK,\n data=json.dumps(data).encode(\"utf-8\"),\n headers=headers,\n method=\"POST\"\n )\n\n with request.urlopen(req) as response:\n response_body = response.read().decode(\"utf-8\")\n return func.HttpResponse(response_body)One slightly tricky point was that Discord’s webhook seemed to blacklist urllib as a UA, so I changed the UA to curl.
Once the code is finished, you can deploy the Function you created to any Function App from the Deploy to Function App button in VSCode.
After deployment completes, you can confirm that the locally created Function has been added to the Azure Function App.
\nNow, when a cost alert occurs and the action group sends notifications, Discord is notified in addition to SMS and email.
\nI configured cost alerts in Azure and also set up notifications to Discord through a Function.
\nAction groups in particular seem like they could handle all kinds of automation once you get comfortable with them, which is exciting.
","fields":{"slug":"/azure-setup-on-money-en","tagSlugs":["/tag/security-en/","/tag/azure-en/","/tag/備忘録/","/tag/english/"]},"frontmatter":{"date":"2022-02-12","description":"","tags":["Security (en)","Azure (en)","備忘録","English"],"title":"Notes on Setting Up Cost Alerts to Use Azure Safely","socialImage":{"publicURL":"/static/40d9f783286082e7cbb69c0b4caa1c73/azure-setup-on-money.png"}}}},"pageContext":{"slug":"/azure-setup-on-money-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}