## Helper Functions
<#
    Helper function for merging hashtables
    <https://stackoverflow.com/questions/8800375/merging-hashtables-in-powershell-how>
#>

function Merge-HashTable {
    param(
        [hashtable] $OriginTable, # your original set
        [hashtable] $Append # the set you want to update/Append to the original set
    )

    # clone for idempotence
    $OriginTable1 = $OriginTable.Clone() ;

    # we need to remove any key-value pairs in $OriginTable1 that we will
    # be replacing with key-value pairs from $uppend
    foreach ($key in $Append.Keys) {
        if ($OriginTable1.ContainsKey($key)) {
            $OriginTable1.Remove($key) ;
        }
    }

    # union both sets
    return $OriginTable1 + $Append ;
}

## Runbook Variables
# Resource types that are untaggable
$exAzureResources = @(
    "Microsoft.ClassicNetwork/virtualNetworks"
    "Microsoft.ClassicStorage/storageAccounts"
    "Microsoft.ClassicCompute/domainNames"
    "Microsoft.ClassicCompute/virtualMachines"
    "Microsoft.OperationsManagement/solutions"
    "Microsoft.DomainRegistration/domains"
    "microsoft.insights/alertrules"
    "microsoft.insights/webtests"
    "TrendMicro.DeepSecurity/accounts"
    "Microsoft.Automation/automationAccounts/configurations"
)

# Counters for results
$tagCounterSuccess      = 0
$tagCounterFail         = 0
$tagCounterSkip         = 0
$tagCounterNull         = 0
$tagCounterUntaggable   = 0
$tagCounterError        = 0

## Connect to Azure with Run As account
$Conn = Get-AutomationConnection -Name AzureRunAsConnection
$azRMAccountParams = @{
    ServicePrincipal        = $true
    Tenant                  = $Conn.TenantID
    ApplicationId           = $Conn.ApplicationID
    CertificateThumbprint   = $Conn.CertificateThumbprint
}
Add-AzureRMAccount @azRMAccountParams | Out-Null

## Script main
try {
    /write-host
    # Capture Tags from Resource Group
    $azResourceGroups = Get-AzureRmResourceGroup

    # Iterate through groups and set tags
    foreach ($azResourceGroup in $azResourceGroups) {
        # Get Resources in the Resource Group
        $azResources = Get-AzureRmResource | Where-Object {
            $_.ResourceGroupName -like $azResourceGroup.ResourceGroupName
        }
        # Standard TFL tags
        $tflTags = @{
            "SvcName"       = $null
            "SvcOwner"      = $null
            "CrgCostCode"   = $null
            "Environment"   = $null
        }
        # Temp var to store RG tags before merge
        $tempTable = @{}
        # Test for Tags property
        switch ($azResourceGroup.PSObject.Properties['Tags']) {
            # If Tags property is present
            ({$PSItem.Value})
            {
                # Iterate through Resource Group Tags
                foreach ($kvpRG in $azResourceGroup.Tags.GetEnumerator()) {
                    # Iterate through TFL Tags
                    foreach ($kvpTag in $tflTags.GetEnumerator()) {
                        # If match is found add Resource Group Tag/Value to $tempTable
                        if ($kvpTag.Key -like $kvpRG.Key) {
                            $tempTable.Add($kvpRG.Key,$kvpRG.Value)
                        }
                    }
                }
            }
            # If Tags property is not present
            ({!($PSItem.Value)})
            {
                $tagCounterNull++
                # Log this for informational purposes
                Write-Output "No Tags set on $($azResourceGroup.ResourceGroupName)"
            }
        }

        # Merge TFL Tags with the Resource Group Tags
        # We do it this way so that even if it's blank the key is added
        $mergeTableRGParams = @{
            "OriginTable"   = $tflTags
            "Append"        = $tempTable
        }
        $mergeTableRG = Merge-HashTable @mergeTableRGParams

        # Iterate through the Resources
        foreach ($azResource in $azResources) {
            # Test if resourceType is classic
            switch ($azResource.ResourceType) {
                # If in the exclude list ignore
                ({$PSItem -in $exAzureResources})
                {
                    $tagCounterUntaggable++
                    break
                    # Uncomment for debugging purposes
                    #Write-Output "$($azResource.ResourceName) is not a taggable resource"
                }
                # If not in the exclude list
                ({!($PSItem -in $exAzureResources)})
                {
                    continue
                }
            } # End Classic Resource test
            # Test each Resource for Tags property
            switch ($azResource.PSObject.Properties['Tags']) {
                # If Tags property is present
                ({$PSItem})
                {
                    # Capture Tags hashtable to var
                    $azResourceTags = $azResource.Tags
                }
                # If Tags property is not present
                ({!($PSItem)})
                {
                    # Create blank/dummy hashtable for the merge
                    $azResourceTags = @{}
                }
            }

            # Final merge with all tags for resource
            $mergeTable = Merge-HashTable -OriginTable $mergeTableRG -Append $azResourceTags

            # Test if tags are up to date
            # Convert hastables to PSCustomObject so that we can use Compare-Object
            $currentTags = [PSCustomObject]$azResourceTags
            $newTags = [PSCustomObject]$mergeTable
            switch (!(Compare-Object $currentTags.PSObject.Properties $newTags.PSObject.Properties)) {
                # If tags match skip
                ({$PSItem})
                {
                    $tagCounterSkip++
                    break
                    # Commented out to avoid noise
                    # Uncomment for debugging purposes
                    #Write-Output "Skip $($azResource.ResourceName)"
                }
                # If mismatch then tag
                ({!($PSItem)})
                {
                    continue
                }
            } # End Tagging switch
            try {
                # Get-AzureRmResource Paramaters
                $GetAzureRmResourceParams = @{
                    ResourceName        = $azResource.ResourceName
                    ResourceGroupName   = $azResourceGroup.ResourceGroupName
                }
                # Set-AzureRmResource Parameters
                $SetAzureRmResourceParams = @{
                    Tag     = $mergeTable
                    Force   = $true
                }
                # Run tagging command
                Write-Output "Tagging $($azResource.ResourceName)..."
                Get-AzureRmResource @GetAzureRmResourceParams | Set-AzureRmResource @SetAzureRmResourceParams | Out-Null
                # Verify Tagging was successful
                # Grab new Tags
                $verifyTagsTest = [PSCustomObject](Get-AzureRmResource @GetAzureRmResourceParams).Tags
                # Compare current tags to what *SHOULD* have been applied
                switch (!(Compare-Object $verifyTagsTest.PSObject.Properties $newTags.PSObject.Properties)) {
                    # If match, log successfull
                    ({$PSItem})
                    {
                        $tagCounterFail++
                        Write-Warning -Message "$($azResource.ResourceName) failed tagging"
                        Write-Warning -Message "Error message: $($Error[0])"
                    }
                    # If they don't match log and log last error for debugging
                    ({!($PSItem)})
                    {
                        $tagCounterSuccess++
                        Write-Output "$($azResource.ResourceName) was tagged successfully"
                    }
                }
            }
            catch {
                $tagCounterError++
                Write-Warning -Message "Unable to set tag"
                Write-Warning -Message "Error message: $($Error[0])"
            }
        } # End Resource loop
    } # End Resource Group loop

    ## Final Script Output
    $outputTable = @{
        "Resources Tagged"          = $tagCounterSuccess
        "Resources Failed Tagging"  = $tagCounterFail
        "Resources Skipped Tagging" = $tagCounterSkip
        "Resource Groups w/o Tags"  = $tagCounterNull
        "Resources Untaggable"      = $tagCounterUntaggable
        "Errors"                    = $tagCounterError
    }
    $Output = [PSCustomObject]$outputTable
    return $Output
}
catch {
    # Capture all errors
    $errorMessage = @(
        "Error in Runbook: Unhandled exception ::"
        "Line: $($_.InvocationInfo.ScriptLineNumber)"
        "Line: $($_.InvocationInfo.Line.Trim())"
        "Error message: $($_.exception.message)"
    )
    # Output errors for debugging and halt runbook
    throw ($errorMessage -join " ") |Out-Null
}