Azure MLOps Retail Forecast Platform > IDENTITY & Resource Group Foundation

IDENTITY & Resource Group Foundation

Trong phần này, chúng ta sẽ tạo nền tảng cơ bản cho hệ thống MLOps bằng cách thiết lập Resource Group và phân quyền Identity & Access Management (IAM). Resource Group sẽ là container logic để quản lý tập trung các tài nguyên Azure liên quan đến dự án, trong khi IAM đảm bảo việc kiểm soát truy cập và bảo mật theo nguyên tắc least privilege. Đây là bước đầu tiên quan trọng trước khi triển khai các thành phần MLOps khác như Azure ML Workspace, Storage, và Compute Resources.

1. Mục tiêu

✅ Tạo Resource Group riêng cho môi trường development
✅ Thiết lập tagging strategy chuẩn enterprise
✅ Cấu hình RBAC permissions phù hợp
✅ Đảm bảo cost tracking và governance

TASK 2 — IDENTITY & RESOURCE GROUP
Mục tiêu: RG + AAD/RBAC, tạm 4 người = Contributor ở scope RG. UI: Resource groups → Create retail-dev-rg (+ Tags). Entra ID: Users/Groups (CloudEngineer, DataEngineer, Analyst, Owners). App Registration (Service Principal) cho DevOps. Khi có AML WS: gán MI quyền AcrPull (ACR), Storage Blob Data Reader, Key Vault Secrets User, ML Workspace Contributor. Bằng chứng: Ảnh RG/Tags; Users/Groups; IAM assignments; App Registration. Done: 4 user OK; SP OK; quyền gán xong.

2. RESOURCE GROUP SETUP

2.1 Basic Configuration

🔧 Resource Group Settings

1. Basic Configuration:

Resource Group name: retail-dev-rg
Subscription: [Your Azure subscription]
Region: Southeast Asia (southeastasia)
Purpose: Container cho tất cả Azure resources của MLOps project

2. Naming Convention:

Format: {project}-{environment}-rg
Benefits: Dễ dàng identify, automate, và manage lifecycle
Consistency: Sẽ có retail-staging-rg, retail-prod-rg sau này

2.2 UI Flow (Azure Portal)

Step 1: Navigate to Resource Groups

Azure Portal → Resource groups → Create resource group

Step 2: Basic Configuration

Subscription: [Your subscription]
Resource group name: retail-dev-rg
Region: Southeast Asia

Step 3: Tags Configuration

Environment: development
Project: retail-forecast
Owner: mlops-team
CostCenter: ml-engineering
Purpose: mlops-platform
DataClassification: internal
CreatedBy: {your-email}

Step 4: Review & Create

# Xem lại cấu hình
Subscription: [Your Subscription]
Resource Group: retail-dev-rg  
Region: Southeast Asia
Tags: 7 tags configured

# Click "Create" để tạo Resource Group

2.3 Tags Strategy

🏷️ Enterprise Tagging Strategy

Required Tags cho MLOps Project:

Tag Name	Value	Purpose	Example
`Environment`	`development`	Môi trường deployment	dev/staging/prod
`Project`	`retail-forecast`	Tên dự án	retail-forecast
`Owner`	`mlops-team`	Team sở hữu	mlops-team
`CostCenter`	`ml-engineering`	Cost allocation	ml-engineering
`CreatedBy`	`{your-email}`	Người tạo	user@company.com
`Purpose`	`mlops-platform`	Mục đích sử dụng	mlops-platform
`DataClassification`	`internal`	Phân loại dữ liệu	internal/confidential

3. IDENTITY & ACCESS MANAGEMENT

3.1 Entra ID Users & Groups Setup

User Groups cần tạo:

👥 Team Structure

1. CloudEngineer Group:

Role: Infrastructure management, DevOps
Members: 1-2 Cloud Engineers
Scope: Resource Group Contributor

2. DataEngineer Group:

Role: Data pipeline, ETL processes
Members: 1-2 Data Engineers
Scope: Resource Group Contributor

3. Analyst Group:

Role: Data analysis, reporting
Members: 1-2 Data Analysts
Scope: Resource Group Contributor

4. Owners Group:

Role: Project management, oversight
Members: 1-2 Project Owners
Scope: Resource Group Contributor

UI Flow:

Azure Portal → Azure Active Directory → Groups → New group

Group Configuration:

Group type: Security
Group name: {role}-retail-dev (e.g., CloudEngineer-retail-dev)
Description: {role} team for retail forecast development
Members: Add users to respective groups

3.2 Service Principal (App Registration)

Purpose: DevOps automation, CI/CD pipelines

UI Flow:

Azure Portal → Azure Active Directory → App registrations → New registration

Configuration:

Name: sp-retail-devops
Supported account types: Single tenant
Redirect URI: Not required for service principal

API Permissions:

Azure Service Management: user_impersonation
Microsoft Graph: Directory.Read.All

Certificates & Secrets:

Create client secret (expires in 12 months)
Save secret value for CI/CD pipeline

4. RBAC PERMISSIONS SETUP

4.1 Resource Group Level Permissions

Assign Contributor role cho 4 groups:

🔑 RBAC Assignments

UI Flow:

Resource Group retail-dev-rg → Access control (IAM) → Add role assignment

Role Assignments:

CloudEngineer-retail-dev → Contributor
DataEngineer-retail-dev → Contributor
Analyst-retail-dev → Contributor
Owners-retail-dev → Contributor
sp-retail-devops → Contributor

Scope: Resource Group level (inherits to all resources)

4.2 Azure ML Workspace Managed Identity Permissions

Khi có Azure ML Workspace, gán cho Managed Identity:

🤖 ML Workspace MI Permissions

Required Role Assignments:

Resource	Role	Purpose
Azure Container Registry	`AcrPull`	Pull container images
Storage Account	`Storage Blob Data Reader`	Read training data
Key Vault	`Key Vault Secrets User`	Access secrets/certificates
Azure ML Workspace	`Machine Learning Workspace Contributor`	Manage ML resources

Scope: Specific resource level (not Resource Group)

5. CLI COMMANDS (REFERENCE)

5.1 Azure CLI Setup

# Login to Azure
az login

# Set subscription
az account set --subscription "your-subscription-id"

# Create Resource Group with tags
az group create \
  --name retail-dev-rg \
  --location southeastasia \
  --tags \
    Environment=development \
    Project=retail-forecast \
    Owner=mlops-team \
    CostCenter=ml-engineering \
    Purpose=mlops-platform \
    DataClassification=internal \
    CreatedBy=$(az account show --query user.name --output tsv)

5.2 RBAC Assignments

# Get Resource Group ID
RG_ID=$(az group show --name retail-dev-rg --query id --output tsv)

# Assign Contributor role to groups
for GROUP in "CloudEngineer-retail-dev" "DataEngineer-retail-dev" "Analyst-retail-dev" "Owners-retail-dev"; do
  az role assignment create \
    --assignee $GROUP \
    --role "Contributor" \
    --scope $RG_ID
done

# Assign Contributor to Service Principal
az role assignment create \
  --assignee $(az ad sp list --display-name sp-retail-devops --query '[0].objectId' -o tsv) \
  --role "Contributor" \
  --scope $RG_ID

5.3 Service Principal Creation

# Create Service Principal
APP=$(az ad sp create-for-rbac \
  --name sp-retail-devops \
  --role Contributor \
  --scopes $RG_ID \
  --sdk-auth)

# Save credentials
echo "$APP" > sp-retail-devops.json

# Login using Service Principal
az login --service-principal \
  -u $(jq -r .clientId sp-retail-devops.json) \
  -p $(jq -r .clientSecret sp-retail-devops.json) \
  --tenant $(jq -r .tenantId sp-retail-devops.json)

6. BẰNG CHỨNG HOÀN THÀNH

6.1 Ảnh 1: Resource Group Overview

📋 Yêu cầu screenshot:

✅ Trang Overview của retail-dev-rg
✅ Hiển thị Region: Southeast Asia
✅ Status: Active
✅ Subscription name visible

6.2 Ảnh 2: Tags Configuration

🏷️ Yêu cầu screenshot:

✅ Tab "Tags" của Resource Group
✅ Hiển thị đầy đủ 7 tags đã cấu hình
✅ Values chính xác theo bảng trên

6.3 Ảnh 3: Entra ID Users/Groups

👥 Yêu cầu screenshot:

✅ Azure AD → Groups
✅ Hiển thị 4 groups: CloudEngineer, DataEngineer, Analyst, Owners
✅ Group names và member counts visible

6.4 Ảnh 4: App Registration

🔐 Yêu cầu screenshot:

✅ Azure AD → App registrations
✅ Application: sp-retail-devops
✅ Client ID và tenant ID visible
✅ Certificates & secrets configured

6.5 Ảnh 5: IAM Assignments

🔑 Yêu cầu screenshot:

✅ Resource Group → Access control (IAM)
✅ Role assignments tab
✅ 5 assignments visible: 4 groups + 1 service principal
✅ All assigned Contributor role

6.6 Ảnh 6: Group Memberships

👥 Yêu cầu screenshot:

✅ Azure AD → Groups → CloudEngineer-retail-dev → Members
✅ List of users in the group
✅ User names and email addresses visible
✅ Member count matches expected

6.7 Ảnh 7: Service Principal Credentials

🔐 Yêu cầu screenshot:

✅ Azure AD → App registrations → sp-retail-devops → Certificates & secrets
✅ Client secrets section
✅ Secret value hidden (shows as dots/asterisks)
✅ Expiration date visible

🔑 Yêu cầu screenshot:

✅ Azure CLI login successful
✅ az account show output showing correct subscription
✅ az group show command working
✅ User/SP permissions verified

7. TIÊU CHÍ HOÀN THÀNH

7.1 Functional Requirements

Resource Group created: retail-dev-rg hiển thị trong portal
Correct region: Southeast Asia location
Tagging complete: Đầy đủ 7 tags theo chuẩn
Active status: Resource Group ở trạng thái Active

7.2 Identity & Access Requirements

4 User Groups created: CloudEngineer, DataEngineer, Analyst, Owners
Service Principal created: sp-retail-devops for DevOps
RBAC configured: All 5 entities assigned Contributor role
Scope correct: Permissions at Resource Group level

7.3 Security Requirements

Least privilege: Appropriate role assignments
Audit logging: Activity log tracking enabled
Access review: Verify quyền truy cập phù hợp

8. AUTOMATION SCRIPT

8.1 Complete Setup Script

#!/bin/bash
# setup-resource-group.sh

# Variables
SUBSCRIPTION_ID="your-subscription-id"
RG_NAME="retail-dev-rg"
LOCATION="southeastasia"

# Set subscription
az account set --subscription $SUBSCRIPTION_ID

# Create resource group with tags
echo "🏗️ Creating Resource Group..."
az group create \
  --name $RG_NAME \
  --location $LOCATION \
  --tags \
    Environment=development \
    Project=retail-forecast \
    Owner=mlops-team \
    CostCenter=ml-engineering \
    Purpose=mlops-platform \
    DataClassification=internal \
    CreatedBy=$(az account show --query user.name --output tsv)

# Get Resource Group ID
RG_ID=$(az group show --name $RG_NAME --query id --output tsv)

# Create Service Principal
echo "🔐 Creating Service Principal..."
az ad sp create-for-rbac \
  --name sp-retail-devops \
  --role Contributor \
  --scopes $RG_ID \
  --sdk-auth > sp-retail-devops.json

echo "✅ Resource Group and Service Principal created successfully!"
echo "📁 Service Principal credentials saved to sp-retail-devops.json"

# Display Resource Group info
echo "📋 Resource Group Details:"
az group show --name $RG_NAME --output table

9. HƯỚNG DẪN ĐĂNG NHẬP

9.1 Đăng nhập bằng User Account

Cho 4 user groups (CloudEngineer, DataEngineer, Analyst, Owners):

# Đăng nhập bằng Azure CLI
az login

# Chọn đúng subscription
az account set --subscription "your-subscription-id"

# Verify quyền truy cập
az group show --name retail-dev-rg

Kiểm tra quyền truy cập:

# Xem role assignments của user hiện tại
az role assignment list --assignee $(az account show --query user.name -o tsv) --scope /subscriptions/{subscription-id}/resourceGroups/retail-dev-rg

# Test tạo resource trong Resource Group
az group show --name retail-dev-rg --output table

9.2 Đăng nhập bằng Service Principal

Cho DevOps automation (sp-retail-devops):

# Method 1: Sử dụng file credentials đã tạo
az login --service-principal \
  -u $(jq -r .clientId sp-retail-devops.json) \
  -p $(jq -r .clientSecret sp-retail-devops.json) \
  --tenant $(jq -r .tenantId sp-retail-devops.json)

# Method 2: Sử dụng environment variables
export AZURE_CLIENT_ID=$(jq -r .clientId sp-retail-devops.json)
export AZURE_CLIENT_SECRET=$(jq -r .clientSecret sp-retail-devops.json)
export AZURE_TENANT_ID=$(jq -r .tenantId sp-retail-devops.json)

az login --service-principal \
  -u $AZURE_CLIENT_ID \
  -p $AZURE_CLIENT_SECRET \
  --tenant $AZURE_TENANT_ID

Verify Service Principal permissions:

# Kiểm tra quyền truy cập
az group show --name retail-dev-rg

# List resources trong Resource Group
az resource list --resource-group retail-dev-rg --output table

Common Issues & Solutions:

⚠️ Troubleshooting Guide

1. “Insufficient privileges” error:

# Kiểm tra user có được add vào group chưa
az ad user show --id user@company.com --query "memberOf"

# Verify group membership
az ad group member list --group CloudEngineer-retail-dev

2. “Invalid credentials” for Service Principal:

# Check if client secret expired
az ad app credential list --id $(jq -r .clientId sp-retail-devops.json)

# Regenerate client secret if needed
az ad app credential reset --id $(jq -r .clientId sp-retail-devops.json)

3. “Resource group not found”:

# Verify subscription context
az account show --output table

# Switch to correct subscription
az account set --subscription "correct-subscription-id"

9.4 Test Access Permissions

Verify Contributor role functionality:

# Test 1: Read Resource Group
az group show --name retail-dev-rg --query "name"

# Test 2: List resources (should work with Contributor)
az resource list --resource-group retail-dev-rg --output table

# Test 3: Create a test storage account (optional)
az storage account create \
  --name teststorage$(date +%s) \
  --resource-group retail-dev-rg \
  --location southeastasia \
  --sku Standard_LRS

# Test 4: Clean up test resource
az storage account delete \
  --name teststorage$(date +%s) \
  --resource-group retail-dev-rg \
  --yes

10. LƯU Ý QUAN TRỌNG

10.1 Environment Strategy

⚠️ Multi-Environment Setup

Development: retail-dev-rg ← Current
Staging: retail-staging-rg ← Future
Production: retail-prod-rg ← Future

Mỗi môi trường cần Resource Group riêng để isolation và governance.

10.2 Cost Management

💰 Budget alerts: Thiết lập budget cho Resource Group
📊 Cost analysis: Monitor chi phí theo tags
🔄 Lifecycle policies: Auto-cleanup dev resources
📈 Resource utilization: Track usage metrics

10.3 Next Steps

✅ Resource Group created ← Current step
🔄 Storage Account setup ← Next step
🔄 Key Vault configuration
🔄 Azure ML Workspace
🔄 Container Registry setup

Best Practice: Resource Group naming convention nên consistent across environments. Format: {project}-{environment}-rg giúp dễ dàng automation và governance.

Security Note: Không assign Owner permissions cho service principals. Sử dụng Contributor role với custom policies khi cần thiết. Managed Identity permissions sẽ được gán khi tạo Azure ML Workspace.

11. USEFUL LINKS

Azure Resource Groups: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview
Azure RBAC: https://docs.microsoft.com/en-us/azure/role-based-access-control/
Service Principals: https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
Azure AD Groups: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal

Resource Group foundation hoàn tất! 🎉 Tiếp tục với Task 3: Data Upload & Storage Configuration.

IDENTITY & Resource Group Foundation

1. Mục tiêu

2. RESOURCE GROUP SETUP

2.1 Basic Configuration

2.2 UI Flow (Azure Portal)

2.3 Tags Strategy

3. IDENTITY & ACCESS MANAGEMENT

3.1 Entra ID Users & Groups Setup

3.2 Service Principal (App Registration)

4. RBAC PERMISSIONS SETUP

4.1 Resource Group Level Permissions

4.2 Azure ML Workspace Managed Identity Permissions

5. CLI COMMANDS (REFERENCE)

5.1 Azure CLI Setup

5.2 RBAC Assignments

5.3 Service Principal Creation

6. BẰNG CHỨNG HOÀN THÀNH

6.1 Ảnh 1: Resource Group Overview

6.2 Ảnh 2: Tags Configuration

6.3 Ảnh 3: Entra ID Users/Groups

6.4 Ảnh 4: App Registration

6.5 Ảnh 5: IAM Assignments

6.6 Ảnh 6: Group Memberships

6.7 Ảnh 7: Service Principal Credentials

6.8 Ảnh 8: Login Test Results

7. TIÊU CHÍ HOÀN THÀNH

7.1 Functional Requirements

7.2 Identity & Access Requirements

7.3 Security Requirements

8. AUTOMATION SCRIPT

8.1 Complete Setup Script

9. HƯỚNG DẪN ĐĂNG NHẬP

9.1 Đăng nhập bằng User Account

9.2 Đăng nhập bằng Service Principal

9.3 Troubleshooting Login Issues

9.4 Test Access Permissions

10. LƯU Ý QUAN TRỌNG

10.1 Environment Strategy

10.2 Cost Management

10.3 Next Steps

11. USEFUL LINKS