Disaster Recovery with Site Recovery

# Create a Recovery Services vault in the DR region
az backup vault create \
  --resource-group rg-dr-westus \
  --name rsv-dr-westus \
  --location westus2

# Note: ASR configuration is primarily done through the portal or PowerShell
# because the Azure CLI has limited ASR support.
# The following uses Azure PowerShell for full ASR configuration:

# PowerShell: Set up ASR for Azure-to-Azure VM replication
# Connect-AzAccount

# Set the vault context
$vault = Get-AzRecoveryServicesVault -Name "rsv-dr-westus" -ResourceGroupName "rg-dr-westus"
Set-AzRecoveryServicesAsrVaultContext -Vault $vault

# Create ASR fabric for source and target regions
$sourceFabric = New-AzRecoveryServicesAsrFabric \
  -Name "asr-fabric-eastus" \
  -Azure \
  -Location "eastus"

$targetFabric = New-AzRecoveryServicesAsrFabric \
  -Name "asr-fabric-westus2" \
  -Azure \
  -Location "westus2"

# Create protection containers
$sourceContainer = New-AzRecoveryServicesAsrProtectionContainer \
  -Name "asr-container-eastus" \
  -Fabric $sourceFabric

$targetContainer = New-AzRecoveryServicesAsrProtectionContainer \
  -Name "asr-container-westus2" \
  -Fabric $targetFabric

# Create replication policy
$policy = New-AzRecoveryServicesAsrPolicy \
  -Name "24-hour-retention" \
  -ReplicationProvider "A2A" \
  -RecoveryPointRetentionInHours 24 \
  -ApplicationConsistentSnapshotFrequencyInHours 4 \
  -MultiVmSyncStatus Enable

# Create container mapping (source -> target)
New-AzRecoveryServicesAsrProtectionContainerMapping \
  -Name "eastus-to-westus2" \
  -Policy $policy \
  -PrimaryProtectionContainer $sourceContainer \
  -RecoveryProtectionContainer $targetContainer

# Get the source VM
$vm = Get-AzVM -ResourceGroupName "rg-app-prod" -Name "vm-webserver-01"

# Get the disk details
$osDisk = New-AzRecoveryServicesAsrAzureToAzureDiskReplicationConfig `
  -ManagedDisk `
  -LogStorageAccountId "/subscriptions/<sub-id>/resourceGroups/rg-dr-westus/providers/Microsoft.Storage/storageAccounts/stasrcache" `
  -DiskId $vm.StorageProfile.OsDisk.ManagedDisk.Id `
  -RecoveryResourceGroupId "/subscriptions/<sub-id>/resourceGroups/rg-app-dr" `
  -RecoveryReplicaDiskAccountType "Premium_LRS" `
  -RecoveryTargetDiskAccountType "Premium_LRS"

# Enable replication
New-AzRecoveryServicesAsrReplicationProtectedItem `
  -AzureToAzure `
  -AzureVmId $vm.Id `
  -Name "vm-webserver-01-asr" `
  -ProtectionContainerMapping $containerMapping `
  -AzureToAzureDiskReplicationConfiguration @($osDisk) `
  -RecoveryResourceGroupId "/subscriptions/<sub-id>/resourceGroups/rg-app-dr" `
  -RecoveryAvailabilityZone "1" `
  -RecoveryAzureNetworkId "/subscriptions/<sub-id>/resourceGroups/rg-network-dr/providers/Microsoft.Network/virtualNetworks/vnet-dr" `
  -RecoveryAzureSubnetName "snet-app"

# Monitor replication health
Get-AzRecoveryServicesAsrReplicationProtectedItem `
  -ProtectionContainer $sourceContainer | `
  Select-Object FriendlyName, ProtectionState, ReplicationHealth, `
  TestFailoverState, ActiveLocation

# Create a recovery plan with ordered groups
$plan = New-AzRecoveryServicesAsrRecoveryPlan `
  -Name "rp-myapp-full" `
  -PrimaryFabric $sourceFabric `
  -RecoveryFabric $targetFabric `
  -ReplicationProtectedItem @($dbVm, $appVm1, $appVm2, $webVm1, $webVm2)

# Edit the plan to define startup order
# Group 1: Database servers (start first)
# Group 2: Application servers (start after DB)
# Group 3: Web servers (start last)

$plan = Edit-AzRecoveryServicesAsrRecoveryPlan -RecoveryPlan $plan

# Add a pre-action script to Group 2 (runs before app servers start)
# This script could update connection strings or validate database availability
$scriptAction = New-AzRecoveryServicesAsrRecoveryPlanAction `
  -Name "Validate-Database" `
  -RunbookId "/subscriptions/<sub-id>/resourceGroups/rg-automation/providers/Microsoft.Automation/automationAccounts/aa-dr/runbooks/Validate-DatabaseConnection" `
  -FabricSide "Primary" `
  -ActionType "AutomationRunbook"

# Add a post-action to Group 3 (runs after web servers start)
$healthCheck = New-AzRecoveryServicesAsrRecoveryPlanAction `
  -Name "Health-Check" `
  -RunbookId "/subscriptions/<sub-id>/resourceGroups/rg-automation/providers/Microsoft.Automation/automationAccounts/aa-dr/runbooks/Run-HealthCheck" `
  -FabricSide "Primary" `
  -ActionType "AutomationRunbook"

# View recovery plan details
Get-AzRecoveryServicesAsrRecoveryPlan -Name "rp-myapp-full" | `
  Select-Object Name, @{N="Groups"; E={$_.Groups.Count}}, `
  @{N="VMs"; E={($_.Groups | ForEach-Object { $_.ReplicationProtectedItems }).Count}}

// Deploy VMs across availability zones for intra-region HA
param location string = 'eastus'
param vmCount int = 3

resource availabilityZoneVMs 'Microsoft.Compute/virtualMachines@2023-09-01' = [for i in range(0, vmCount): {
  name: 'vm-web-${padLeft(string(i + 1), 2, '0')}'
  location: location
  zones: [string((i % 3) + 1)] // Distribute across zones 1, 2, 3
  properties: {
    hardwareProfile: {
      vmSize: 'Standard_D4s_v5'
    }
    storageProfile: {
      osDisk: {
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: 'Premium_ZRS' // Zone-redundant storage
        }
      }
      imageReference: {
        publisher: 'Canonical'
        offer: '0001-com-ubuntu-server-jammy'
        sku: '22_04-lts-gen2'
        version: 'latest'
      }
    }
    osProfile: {
      computerName: 'vm-web-${padLeft(string(i + 1), 2, '0')}'
      adminUsername: 'azureuser'
      linuxConfiguration: {
        disablePasswordAuthentication: true
        ssh: {
          publicKeys: [
            {
              path: '/home/azureuser/.ssh/authorized_keys'
              keyData: loadTextContent('id_rsa.pub')
            }
          ]
        }
      }
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nics[i].id
        }
      ]
    }
  }
}]

// Zone-redundant load balancer
resource loadBalancer 'Microsoft.Network/loadBalancers@2023-06-01' = {
  name: 'lb-web-prod'
  location: location
  sku: {
    name: 'Standard'  // Standard SKU required for zone redundancy
    tier: 'Regional'
  }
  properties: {
    frontendIPConfigurations: [
      {
        name: 'frontend'
        zones: ['1', '2', '3']  // Zone-redundant frontend
        properties: {
          publicIPAddress: {
            id: publicIP.id
          }
        }
      }
    ]
  }
}

# Create a Recovery Services vault for backups
az backup vault create \
  --resource-group rg-backup \
  --name rsv-backup-prod \
  --location eastus

# Create a backup policy
az backup policy create \
  --resource-group rg-backup \
  --vault-name rsv-backup-prod \
  --name policy-vm-daily \
  --backup-management-type AzureIaasVM \
  --policy '{
    "schedulePolicy": {
      "schedulePolicyType": "SimpleSchedulePolicy",
      "scheduleRunFrequency": "Daily",
      "scheduleRunTimes": ["2024-01-01T02:00:00Z"]
    },
    "retentionPolicy": {
      "retentionPolicyType": "LongTermRetentionPolicy",
      "dailySchedule": {
        "retentionTimes": ["2024-01-01T02:00:00Z"],
        "retentionDuration": { "count": 30, "durationType": "Days" }
      },
      "weeklySchedule": {
        "daysOfTheWeek": ["Sunday"],
        "retentionTimes": ["2024-01-01T02:00:00Z"],
        "retentionDuration": { "count": 12, "durationType": "Weeks" }
      },
      "monthlySchedule": {
        "retentionScheduleFormatType": "Weekly",
        "retentionScheduleWeekly": {
          "daysOfTheWeek": ["Sunday"],
          "weeksOfTheMonth": ["First"]
        },
        "retentionTimes": ["2024-01-01T02:00:00Z"],
        "retentionDuration": { "count": 12, "durationType": "Months" }
      }
    }
  }'

# Enable backup for a VM
az backup protection enable-for-vm \
  --resource-group rg-backup \
  --vault-name rsv-backup-prod \
  --vm /subscriptions/<sub-id>/resourceGroups/rg-app/providers/Microsoft.Compute/virtualMachines/vm-webserver-01 \
  --policy-name policy-vm-daily

# Trigger an on-demand backup
az backup protection backup-now \
  --resource-group rg-backup \
  --vault-name rsv-backup-prod \
  --container-name "IaasVMContainerV2;rg-app;vm-webserver-01" \
  --item-name "vm-webserver-01" \
  --retain-until 2024-02-15

# Create a Traffic Manager profile with priority routing
az network traffic-manager profile create \
  --resource-group rg-dr \
  --name tm-myapp-dr \
  --routing-method Priority \
  --unique-dns-name myapp-global \
  --ttl 60 \
  --protocol HTTPS \
  --port 443 \
  --path "/health" \
  --interval 10 \
  --timeout 5 \
  --max-failures 3

# Add primary endpoint (East US)
az network traffic-manager endpoint create \
  --resource-group rg-dr \
  --profile-name tm-myapp-dr \
  --name ep-eastus-primary \
  --type azureEndpoints \
  --target-resource-id /subscriptions/<sub-id>/resourceGroups/rg-app-eastus/providers/Microsoft.Web/sites/myapp-eastus \
  --priority 1 \
  --endpoint-status Enabled

# Add secondary endpoint (West US - DR site)
az network traffic-manager endpoint create \
  --resource-group rg-dr \
  --profile-name tm-myapp-dr \
  --name ep-westus-secondary \
  --type azureEndpoints \
  --target-resource-id /subscriptions/<sub-id>/resourceGroups/rg-app-westus/providers/Microsoft.Web/sites/myapp-westus \
  --priority 2 \
  --endpoint-status Enabled

# Check Traffic Manager endpoint health
az network traffic-manager endpoint show \
  --resource-group rg-dr \
  --profile-name tm-myapp-dr \
  --name ep-eastus-primary \
  --type azureEndpoints \
  --query '{Name:name, Status:endpointStatus, MonitorStatus:endpointMonitorStatus, Priority:priority}' \
  --output table

# Simulate failover: disable the primary endpoint
az network traffic-manager endpoint update \
  --resource-group rg-dr \
  --profile-name tm-myapp-dr \
  --name ep-eastus-primary \
  --type azureEndpoints \
  --endpoint-status Disabled

# Create a primary SQL server (East US)
az sql server create \
  --resource-group rg-data-eastus \
  --name sql-myapp-eastus \
  --location eastus \
  --admin-user sqladmin \
  --admin-password "<strong-password>"

# Create a secondary SQL server (West US) for DR
az sql server create \
  --resource-group rg-data-westus \
  --name sql-myapp-westus \
  --location westus \
  --admin-user sqladmin \
  --admin-password "<strong-password>"

# Create a database on the primary server
az sql db create \
  --resource-group rg-data-eastus \
  --server sql-myapp-eastus \
  --name db-myapp \
  --service-objective S3 \
  --backup-storage-redundancy Geo

# Create an auto-failover group
az sql failover-group create \
  --resource-group rg-data-eastus \
  --server sql-myapp-eastus \
  --partner-server sql-myapp-westus \
  --partner-resource-group rg-data-westus \
  --name fog-myapp \
  --add-db db-myapp \
  --failover-policy Automatic \
  --grace-period 1

# The failover group creates a listener endpoint:
# fog-myapp.database.windows.net (always points to primary)
# fog-myapp.secondary.database.windows.net (always points to secondary)
# Your application should connect to the listener endpoint

# Test failover (manual trigger)
az sql failover-group set-primary \
  --resource-group rg-data-westus \
  --server sql-myapp-westus \
  --name fog-myapp

# Fail back to original primary
az sql failover-group set-primary \
  --resource-group rg-data-eastus \
  --server sql-myapp-eastus \
  --name fog-myapp

# Create an isolated virtual network for the test
$testVnet = New-AzVirtualNetwork `
  -Name "vnet-dr-test" `
  -ResourceGroupName "rg-dr-testing" `
  -Location "westus2" `
  -AddressPrefix "10.99.0.0/16"

Add-AzVirtualNetworkSubnetConfig `
  -Name "snet-test" `
  -VirtualNetwork $testVnet `
  -AddressPrefix "10.99.1.0/24"

$testVnet | Set-AzVirtualNetwork

# Execute test failover using the recovery plan
$plan = Get-AzRecoveryServicesAsrRecoveryPlan -Name "rp-myapp-full"

Start-AzRecoveryServicesAsrTestFailoverJob `
  -RecoveryPlan $plan `
  -Direction PrimaryToRecovery `
  -AzureVMNetworkId $testVnet.Id

# Monitor test failover progress
Get-AzRecoveryServicesAsrJob | `
  Where-Object { $_.State -eq "InProgress" } | `
  Select-Object Name, State, StartTime, `
  @{N="Duration"; E={(Get-Date) - $_.StartTime}}

# After validation: Clean up test failover resources
Start-AzRecoveryServicesAsrTestFailoverCleanupJob `
  -RecoveryPlan $plan `
  -Comment "DR test completed successfully. All services validated."

# Check ASR replication health for all VMs
az resource list \
  --resource-type "Microsoft.RecoveryServices/vaults" \
  --query "[].{Name:name, ResourceGroup:resourceGroup, Location:location}" \
  --output table

# View backup jobs status
az backup job list \
  --resource-group rg-backup \
  --vault-name rsv-backup-prod \
  --query "[?status=='InProgress' || status=='Failed'].{Job:name, Status:status, StartTime:startTime}" \
  --output table

# Check Traffic Manager endpoint health
az network traffic-manager profile show \
  --resource-group rg-dr \
  --name tm-myapp-dr \
  --query '{Profile:name, Status:profileStatus, Endpoints:endpoints[].{Name:name, Status:endpointStatus, Monitor:endpointMonitorStatus}}' \
  --output json

# Estimate DR costs with resource tags
az cost management query \
  --type Usage \
  --timeframe MonthToDate \
  --dataset-filter '{"Tags": {"Name": "purpose", "Values": ["disaster-recovery"]}}' \
  --query "properties.rows[].{Service:[0], Cost:[1]}" \
  --output table