Azure provides data about spent money on subscriptions for the month.
The forecasted spendings feature doesn't seem very accurate yet (at the time of this writing). Just a little example: you may receive many forecasted alert notifcations at the very beginning of the month.
This function app automatically gathers and outputs budget consumption for the last 30 days by calling Azure API.
It will also allow you to know if you already spent more money than you should have (actual spent money compared to monthly 'budget' amount for the last 30 days)
Coupled with a common monitoring system (nagios, centreon, zabbix, or whatever you use), you'll automatically get alerted as soon as you reached you budget.
- An "app registration" account (client id, valid secret and tenant id).
- Billing reader RBAC role for this account on all subscriptions you want to monitor.
You can find powershell cmdlets in "set-permissions-example" folder ; subscription owner can execute them in a simple Azure cloudshell.
Basically, that would be something like:
$subs = Get-AzSubscription
$appPrincipal = Get-AzADServicePrincipal -DisplayName "my-app-account-name"
foreach ($sub in $subs) {
New-AzRoleAssignment -ObjectId $appPrincipal.id -RoleDefinitionName "Billing Reader" -Scope /subscriptions/$($sub.id)
}
- A budget set in your subscription with a name of your choice (but the same everywhere).
You can find powershell cmdlets in "bulk-budgets-example" folder ; subscription owner can execute them in a simple Azure cloudshell.
That would be something like:
$subs = Get-AzSubscription
$budgetName = "budget"
$startingAmount = "500"
$email = "myemail@company.com"
$startOfMonth = Get-Date -Year (Get-Date).Year -Month (Get-Date).Month -Day 1 -Hour 0 -Minute 0 -Second 0 -Millisecond 0
$end = $startOfMonth.AddYears(10)
foreach ($sub in $subs) {
select-azsubscription -subscription $sub.Name
New-AzConsumptionBudget -Amount $startingAmount -Name $budgetName -Category Cost -StartDate $startOfMonth -EndDate $end -TimeGrain Monthly -ContactEmail $email -NotificationKey email -NotificationThreshold 100
}
Once you have all the requirements, you can deploy the Azure function with de "Deploy" button below:
This will deploy an Azure app function with its storage account, app insights and "consumption" app plan. A keyvault will also be deployed to securely store the secret of your app principal.
Choose you Azure subscription, region and create or select a resource group.
-
App Name:
You can customize a name for resources that will be created. -
Tenant ID:
If your subscription depends on the same tenant than the account used to retrieve subscriptions information, then you can use the default value.
Otherwise, enter the tenant ID of the account. -
Subscription Billing Reader Application ID:
Client ID of the account used to retrieve subscriptions information. -
Subscription Billing Reader Secret:
Secret of the account used to retrieve subscriptions information. -
Budget name:
Name of the budget object you have in all your subscriptions. -
Zip Release URL:
For testing, you can leave it like it.
For more serious use, I would advise you host your own zip file so that you wouldn't be subject to release changes done in this repository.
See below for more details. -
Max Concurrent Jobs:
An API call to Azure will be made for each subscription.
If you have many subscription, you might get an http timeout when calling the function from your monitoring system.
This value allows to make calls to Azure API in parallel.
With the default value, it will take around 30 seconds for ~100 subscriptions. -
Signature:
When this function will be called by your monitoring system, you likely might forget about it.
The signature output will act a reminder since you'll get it in the results to your monitoring system.
When deployment is done, you can get your Azure function's URL in the output variables.
Trigger it manually in your favorite browser and eventually look at the logs in the function.
After you execute the function for the first time, it might (will) need 5-10 minutes before it works because it has to install Az module. You even might get an HTTP 500 error. Give the function some time to initialize, re-execute it again if necessary and be patient, it will work.
Even after that, you might experience issue if Azure takes time to resolve your newly created keyvault:
Wait a short time and then restart your Azure function, your should have something like:
From there, you just have to call your function's URL from your monitoring system.
You can find a script example in "monitoring-script-example" folder which makes a GET request, outputs the result, looks for "CRITICAL" or "WARNING" in the text and use the right exit code accordingly.
Calling the function once a day should be enough.
You have the choice between 2 different approaches:
- 1 function call that will give results for all subscriptions
- 1 function call per subscription by specifying the subscriptionid in the GET parameters: &subscriptionid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
I would prefer option 2 because if you use option and your account lacks permission on a subscription, you just won't get it in the output. By call specifically 1 check per subscription and you manage to add it to your monitoring system properly (by process and/or automation), you can't miss it.
You can modify "warning" and "critical" thresholds within the GET parameters of the URL (just add &warning=80&critical=90 for example).
Default values are 90 and 100 percent.
Be sure to have an appropriate timeout (60s or more) because if you have many subscriptions, the function will need some time to execute.
This is an example of what you'd get in Centreon:
To make your function to stop relying on this repo's zip and become independant, follow these steps:
- remove zipReleaseURL app setting and restart app
- in "App files" section, edit "requirements.psd1" and uncomment the line: 'Az' = '6.*'
- in "Functions" section, add a new function called "AzureSubscriptionBudgetCheck" and paste in it the content of the file release/AzureSubscriptionBudgetCheck/run.ps1 in this repository