Azure Cloud

Azure Cloud

Core Capabilities

Provides expert guidance for Microsoft Azure infrastructure and services:

1. Compute Services - Azure Virtual Machines, Virtual Machine Scale Sets, Azure App Service, Azure Functions, Azure Container Instances 2. Storage Services - Azure Blob Storage, Azure Files, Azure Disk Storage, Azure Data Lake Storage 3. Database Services - Azure SQL Database, Azure Cosmos DB, Azure Database for MySQL/PostgreSQL, Azure Redis Cache 4. Networking - Azure Virtual Network (VNet), Azure Load Balancer, Application Gateway, Azure Front Door, VPN Gateway, ExpressRoute 5. Container Services - AKS (Azure Kubernetes Service), Azure Container Registry, Azure Container Instances 6. Infrastructure as Code - Terraform, Bicep, ARM Templates, Azure CLI, PowerShell 7. Security - Azure Active Directory (Entra ID), Azure Key Vault, Azure Security Center, Azure Sentinel, Azure Policy 8. DevOps & CI/CD - Azure DevOps, Azure Pipelines, GitHub Actions with Azure integration 9. Monitoring - Azure Monitor, Application Insights, Log Analytics, Azure Alerts

Best Practices

Azure Virtual Machines

• Select appropriate VM sizes based on workload (D-series, F-series, E-series)
• Use managed disks for simplified management and availability
• Enable Azure Backup for VM protection
• Use availability sets or availability zones for high availability
• Configure VM extensions for automated configuration
• Enable Azure Disk Encryption for data protection
• Use proximity placement groups for low latency

Azure Storage

• Use storage account types based on use case (Standard vs Premium, Hot/Cool/Archive tiers)
• Enable soft delete for blob and container protection
• Use private endpoints for secure access
• Configure lifecycle management policies for cost optimization
• Enable Azure Storage encryption (SSE)
• Use Azure CDN with Blob Storage for content delivery
• Implement immutable blob storage for compliance

Azure SQL Database

• Select appropriate service tier (Basic, Standard, Premium, Hyperscale)
• Enable automatic backups with long-term retention
• Use read replicas for read scaling
• Configure active geo-replication for disaster recovery
• Enable Transparent Data Encryption (TDE)
• Use Always Encrypted for sensitive data
• Monitor with Query Performance Insight

Azure Virtual Network

• Plan address space carefully using RFC 1918 ranges
• Use subnets to segment workloads and apply NSGs
• Configure Network Security Groups (NSGs) with least privilege
• Use Azure Firewall for centralized network security
• Enable VNet peering for cross-VNet communication
• Use service endpoints and private endpoints for Azure services
• Implement network watcher for diagnostics

AKS (Azure Kubernetes Service)

• Use managed identity for AKS cluster authentication
• Configure multiple node pools with auto-scaling
• Enable Azure Policy for Kubernetes
• Use Azure Container Registry with image scanning
• Implement network policies with Azure CNI or Calico
• Enable cluster monitoring with Container Insights
• Configure ingress controllers with Application Gateway

Security

• Enable Azure AD Multi-Factor Authentication (MFA)
• Use managed identities instead of service principals where possible
• Implement Role-Based Access Control (RBAC) with least privilege
• Store secrets in Azure Key Vault
• Enable Azure Security Center for threat protection
• Use Azure Policy for governance and compliance
• Enable Azure Sentinel for SIEM capabilities
• Audit activities with Azure Activity Log

Cost Optimization

• Use Azure Reserved Instances for predictable workloads
• Leverage Azure Spot VMs for fault-tolerant workloads
• Implement auto-scaling to match demand
• Use Azure Cost Management for budgets and alerts
• Right-size VMs based on Azure Advisor recommendations
• Use Azure Hybrid Benefit for Windows Server and SQL Server
• Configure storage lifecycle policies to reduce costs

DevOps Best Practices

• Use Azure DevOps or GitHub Actions for CI/CD pipelines
• Implement infrastructure as code with Bicep or Terraform
• Use Azure Key Vault for pipeline secrets
• Enable deployment slots for App Service blue-green deployments
• Implement automated testing in pipelines
• Use Azure Artifacts for package management
• Configure branch policies and pull request validation

Detailed References

Load reference files based on specific needs:

• Compute Services: See compute-services.md for Azure VM sizes, families, selection guide, Virtual Machine Scale Sets, Azure App Service, Azure Functions patterns, and Container Instances

• Storage Solutions: See storage-solutions.md for Blob Storage configuration, Azure Files setup, disk types, performance optimization, and storage security

• Container Orchestration: See container-orchestration.md for AKS cluster design, node pool configuration, workload deployment, Container Registry integration, service mesh, and ingress controllers

• Infrastructure as Code: See infrastructure-as-code.md for Bicep templates, ARM patterns, Terraform Azure provider, Azure CLI scripting, and PowerShell automation

• Security Configuration: See security-configuration.md for Azure Key Vault, Network Security Groups, Azure Firewall, Security Center, Defender for Cloud, and Azure Policy

• Monitoring and Diagnostics: See monitoring-diagnostics.md for Azure Monitor, Application Insights, Log Analytics queries (KQL), alert rules, and diagnostic settings

Azure Compute Services

Azure Virtual Machines

VM Size Selection

General Purpose (B, D, DC, DS)

• B-series: Burstable, cost-effective for low baseline CPU usage (dev/test, small web servers)
• D-series: Balanced CPU-to-memory ratio (application servers, databases)
• DC-series: Confidential computing with Intel SGX enclaves

Compute Optimized (F, FS)

• F-series: High CPU-to-memory ratio (batch processing, web servers, analytics)
• Best for CPU-intensive workloads with less memory requirements

Memory Optimized (E, ES, M, MS)

• E-series: High memory-to-CPU ratio (in-memory databases, large caches)
• M-series: Largest memory configurations (SAP HANA, massive databases)

Storage Optimized (L, LS)

• L-series: High disk throughput and IOPS (big data, NoSQL databases)

GPU (N-series)

• NC-series: NVIDIA Tesla for compute workloads (ML training, simulations)
• NV-series: NVIDIA Tesla for visualization (VDI, rendering)
• ND-series: Deep learning training

High Performance Compute (H)

• H-series: HPC workloads with InfiniBand networking (molecular dynamics, CFD)

VM Best Practices

# Create VM with best practices
az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image Ubuntu2204 \
  --size Standard_D4s_v5 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard \
  --nsg-rule SSH \
  --enable-agent true \
  --enable-auto-update true \
  --patch-mode AutomaticByPlatform \
  --storage-sku Premium_LRS \
  --os-disk-encryption-set myEncryptionSet \
  --availability-zone 1

Managed Disks

Disk Types:

• Ultra Disk: Sub-millisecond latency, up to 160,000 IOPS
• Premium SSD v2: Configurable performance, no disk size requirements
• Premium SSD: Consistent low latency, production workloads
• Standard SSD: Cost-effective for web servers, dev/test
• Standard HDD: Lowest cost, infrequent access

Disk Performance Tiers:

# Change disk performance tier without downtime
az disk update \
  --resource-group myResourceGroup \
  --name myDisk \
  --set tier=P40

Availability Options

Availability Zones

• Physically separate zones within a region
• 99.99% SLA with zone-redundant deployment
• Protect from datacenter failures

# Create VM in availability zone
az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image Ubuntu2204 \
  --zone 1

Availability Sets

• Logical grouping within a datacenter
• 99.95% SLA with 2+ VMs in availability set
• Protection from hardware failures

Virtual Machine Scale Sets

• Auto-scaling capabilities
• Load balancer integration
• Up to 1,000 VM instances

Azure App Service

Service Plans

Pricing Tiers:

• Free/Shared: Dev/test, shared infrastructure
• Basic: Dedicated compute, manual scaling
• Standard: Auto-scaling, staging slots, custom domains
• Premium: Enhanced performance, VNet integration, more slots
• Isolated: App Service Environment (ASE), network isolation

Deployment Slots

# Create deployment slot
az webapp deployment slot create \
  --name myWebApp \
  --resource-group myResourceGroup \
  --slot staging

# Swap slots (blue-green deployment)
az webapp deployment slot swap \
  --name myWebApp \
  --resource-group myResourceGroup \
  --slot staging \
  --target-slot production

App Service Configuration

# Configure app settings
az webapp config appsettings set \
  --name myWebApp \
  --resource-group myResourceGroup \
  --settings \
    DATABASE_URL="@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/db-connection)" \
    ENVIRONMENT="production"

# Enable application insights
az webapp config appsettings set \
  --name myWebApp \
  --resource-group myResourceGroup \
  --settings APPINSIGHTS_INSTRUMENTATIONKEY="your-key"

# Configure auto-scaling
az monitor autoscale create \
  --resource-group myResourceGroup \
  --resource myWebApp \
  --resource-type Microsoft.Web/serverFarms \
  --min-count 2 \
  --max-count 10 \
  --count 2

VNet Integration

# Integrate App Service with VNet
az webapp vnet-integration add \
  --name myWebApp \
  --resource-group myResourceGroup \
  --vnet myVNet \
  --subnet appServiceSubnet

Azure Functions

Hosting Plans

Consumption Plan

• Pay-per-execution
• Automatic scaling
• 5-minute execution timeout (10 minutes configurable)
• Best for event-driven, sporadic workloads

Premium Plan

• No cold start with pre-warmed instances
• VNet connectivity
• Unlimited execution duration
• Best for long-running, VNet-connected functions

Dedicated (App Service) Plan

• Run on existing App Service plan
• Predictable billing
• Best for continuous workloads

Function Triggers and Bindings

// HTTP Trigger with Blob output binding
module.exports = async function (context, req) {
    context.log('Processing request');
    
    const name = req.query.name || req.body?.name;
    
    context.bindings.outputBlob = {
        name: name,
        timestamp: new Date()
    };
    
    return {
        status: 200,
        body: `Hello, ${name}`
    };
};

Function.json:

{
  "bindings": [
    {
      "authLevel": "function",
      "type": "httpTrigger",
      "direction": "in",
      "name": "req",
      "methods": ["get", "post"]
    },
    {
      "type": "http",
      "direction": "out",
      "name": "res"
    },
    {
      "type": "blob",
      "direction": "out",
      "name": "outputBlob",
      "path": "output-container/{name}.json",
      "connection": "AzureWebJobsStorage"
    }
  ]
}

Durable Functions

// Orchestrator function for workflow
const df = require("durable-functions");

module.exports = df.orchestrator(function* (context) {
    const outputs = [];
    
    outputs.push(yield context.df.callActivity("ProcessOrder", { orderId: 123 }));
    outputs.push(yield context.df.callActivity("SendNotification", { email: "user@example.com" }));
    outputs.push(yield context.df.callActivity("UpdateInventory", { productId: 456 }));
    
    return outputs;
});

Best Practices

1. Keep functions small and focused - Single responsibility 2. Use async/await - Non-blocking I/O operations 3. Implement retry policies - Handle transient failures 4. Use managed identities - Avoid storing credentials 5. Monitor with Application Insights - Track performance and errors 6. Configure timeout appropriately - Based on expected execution time 7. Use output bindings - Reduce code for Azure service integration

Azure Container Instances

Quick Container Deployment

# Deploy container with public IP
az container create \
  --resource-group myResourceGroup \
  --name mycontainer \
  --image nginx:latest \
  --cpu 1 \
  --memory 1 \
  --ports 80 \
  --dns-name-label myapp-unique-dns \
  --location eastus

# Deploy with environment variables and persistent storage
az container create \
  --resource-group myResourceGroup \
  --name myapp \
  --image myregistry.azurecr.io/myapp:v1 \
  --registry-login-server myregistry.azurecr.io \
  --registry-username myregistry \
  --registry-password myPassword \
  --environment-variables 'DATABASE_URL'='connection-string' \
  --azure-file-volume-account-name mystorageaccount \
  --azure-file-volume-account-key storagekey \
  --azure-file-volume-share-name myshare \
  --azure-file-volume-mount-path /data \
  --cpu 2 \
  --memory 4 \
  --ports 80 443

Multi-Container Groups

# container-group.yaml
apiVersion: 2019-12-01
location: eastus
name: mycontainergroup
properties:
  containers:
  - name: web
    properties:
      image: nginx:latest
      resources:
        requests:
          cpu: 1.0
          memoryInGb: 1.5
      ports:
      - port: 80
        protocol: TCP
  - name: sidecar
    properties:
      image: fluentd:latest
      resources:
        requests:
          cpu: 0.5
          memoryInGb: 0.5
  osType: Linux
  ipAddress:
    type: Public
    ports:
    - protocol: TCP
      port: 80
  restartPolicy: Always
tags: {}
type: Microsoft.ContainerInstance/containerGroups

# Deploy container group
az container create --resource-group myResourceGroup --file container-group.yaml

Use Cases for ACI

1. Burst scaling from AKS - Virtual Kubelet integration 2. CI/CD build agents - Ephemeral build environments 3. Batch processing - Short-lived compute tasks 4. Development/testing - Quick container deployments 5. Event-driven processing - Azure Functions alternative for containers

Azure Container Orchestration (AKS)

AKS Cluster Architecture

Cluster Components

Control Plane (Microsoft-managed)

• API Server
• etcd (cluster state storage)
• Scheduler
• Controller Manager

Node Pools (Customer-managed)

• System node pool (required, runs system pods)
• User node pools (optional, runs application workloads)

Node Pool Types

System Node Pool

• Required for cluster operation
• Runs CoreDNS, metrics-server, tunnelfront
• Minimum 2 nodes recommended
• Use taints to prevent user workloads

User Node Pools

• Run application workloads
• Can be scaled to zero
• Support Windows and Linux nodes
• Multiple pools for different workload types

Creating AKS Cluster

Basic Cluster Creation

# Create AKS cluster with managed identity
az aks create \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --node-count 3 \
  --node-vm-size Standard_D4s_v5 \
  --network-plugin azure \
  --network-policy azure \
  --enable-managed-identity \
  --enable-addons monitoring \
  --generate-ssh-keys \
  --kubernetes-version 1.28.5 \
  --zones 1 2 3

# Get credentials
az aks get-credentials \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --overwrite-existing

Production-Ready Cluster

# Create resource group
az group create --name aks-production-rg --location eastus

# Create Log Analytics workspace for monitoring
az monitor log-analytics workspace create \
  --resource-group aks-production-rg \
  --workspace-name aks-logs

WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group aks-production-rg \
  --workspace-name aks-logs \
  --query id -o tsv)

# Create AKS cluster with production settings
az aks create \
  --resource-group aks-production-rg \
  --name aks-production \
  --location eastus \
  --kubernetes-version 1.28.5 \
  --node-count 3 \
  --min-count 2 \
  --max-count 10 \
  --enable-cluster-autoscaler \
  --node-vm-size Standard_D8s_v5 \
  --node-osdisk-size 128 \
  --network-plugin azure \
  --network-policy azure \
  --load-balancer-sku standard \
  --outbound-type loadBalancer \
  --vnet-subnet-id /subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet} \
  --enable-managed-identity \
  --enable-aad \
  --aad-admin-group-object-ids {AAD-GROUP-ID} \
  --enable-azure-rbac \
  --enable-addons monitoring,azure-keyvault-secrets-provider \
  --workspace-resource-id $WORKSPACE_ID \
  --enable-secret-rotation \
  --rotation-poll-interval 2m \
  --enable-pod-security-policy \
  --zones 1 2 3 \
  --node-osdisk-type Ephemeral \
  --tags Environment=production ManagedBy=AzureCLI

Node Pools

Adding Node Pools

# Add user node pool
az aks nodepool add \
  --resource-group myResourceGroup \
  --cluster-name myAKSCluster \
  --name userpool \
  --node-count 3 \
  --node-vm-size Standard_D8s_v5 \
  --enable-cluster-autoscaler \
  --min-count 2 \
  --max-count 10 \
  --zones 1 2 3 \
  --labels workload=application tier=web \
  --tags team=backend

# Add GPU node pool
az aks nodepool add \
  --resource-group myResourceGroup \
  --cluster-name myAKSCluster \
  --name gpupool \
  --node-count 1 \
  --node-vm-size Standard_NC6s_v3 \
  --enable-cluster-autoscaler \
  --min-count 0 \
  --max-count 3 \
  --labels workload=ml gpu=nvidia \
  --node-taints sku=gpu:NoSchedule

# Add Windows node pool
az aks nodepool add \
  --resource-group myResourceGroup \
  --cluster-name myAKSCluster \
  --name winpool \
  --node-count 2 \
  --os-type Windows \
  --node-vm-size Standard_D4s_v5

# List node pools
az aks nodepool list \
  --resource-group myResourceGroup \
  --cluster-name myAKSCluster -o table

# Scale node pool
az aks nodepool scale \
  --resource-group myResourceGroup \
  --cluster-name myAKSCluster \
  --name userpool \
  --node-count 5

Azure Container Registry (ACR) Integration

Creating ACR

# Create ACR
az acr create \
  --resource-group myResourceGroup \
  --name myContainerRegistry \
  --sku Premium \
  --location eastus \
  --admin-enabled false

# Enable geo-replication
az acr replication create \
  --registry myContainerRegistry \
  --location westus

# Attach ACR to AKS
az aks update \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --attach-acr myContainerRegistry

Building and Pushing Images

# Build image in ACR
az acr build \
  --registry myContainerRegistry \
  --image myapp:v1 \
  --file Dockerfile \
  .

# Import image from Docker Hub
az acr import \
  --name myContainerRegistry \
  --source docker.io/library/nginx:latest \
  --image nginx:latest

# Enable vulnerability scanning
az acr task run \
  --registry myContainerRegistry \
  --name quickscan \
  --image nginx:latest

Kubernetes Deployments on AKS

Deployment Manifest

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: production
  labels:
    app: myapp
    version: v1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
        version: v1
    spec:
      nodeSelector:
        workload: application
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - myapp
              topologyKey: kubernetes.io/hostname
      containers:
      - name: myapp
        image: myContainerRegistry.azurecr.io/myapp:v1
        ports:
        - containerPort: 8080
          name: http
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1Gi
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: database-url
        volumeMounts:
        - name: secrets-store
          mountPath: "/mnt/secrets-store"
          readOnly: true
      volumes:
      - name: secrets-store
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "azure-keyvault"
---
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: production
spec:
  type: ClusterIP
  selector:
    app: myapp
  ports:
  - name: http
    port: 80
    targetPort: 8080
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

Ingress with Application Gateway

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/health-probe-path: "/health"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

Azure Key Vault Integration

SecretProviderClass

# secretproviderclass.yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-keyvault
  namespace: production
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"
    userAssignedIdentityID: "{IDENTITY_CLIENT_ID}"
    keyvaultName: "mykeyvault"
    cloudName: ""
    objects: |
      array:
        - |
          objectName: database-connection-string
          objectType: secret
          objectVersion: ""
        - |
          objectName: api-key
          objectType: secret
          objectVersion: ""
    tenantId: "{TENANT_ID}"
  secretObjects:
  - secretName: app-secrets
    type: Opaque
    data:
    - objectName: database-connection-string
      key: database-url
    - objectName: api-key
      key: api-key

Monitoring and Logging

Container Insights

# Enable Container Insights
az aks enable-addons \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --addons monitoring \
  --workspace-resource-id $WORKSPACE_ID

# Query logs with KQL
az monitor log-analytics query \
  --workspace $WORKSPACE_ID \
  --analytics-query "ContainerLog | where TimeGenerated > ago(1h) | limit 100" \
  --output table

Prometheus and Grafana

# Add Prometheus Helm repo
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# Install kube-prometheus-stack
helm install prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace \
  --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false \
  --set prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false

# Access Grafana
kubectl port-forward -n monitoring svc/prometheus-grafana 3000:80

Network Policies

# network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-traffic
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - podSelector: {}
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

Backup and Disaster Recovery

Velero for AKS

# Install Velero
AZURE_BACKUP_RESOURCE_GROUP=aks-backup-rg
AZURE_STORAGE_ACCOUNT_ID=aksbackupstorage

# Create storage account for backups
az storage account create \
  --name $AZURE_STORAGE_ACCOUNT_ID \
  --resource-group $AZURE_BACKUP_RESOURCE_GROUP \
  --sku Standard_GRS \
  --location eastus

# Create blob container
az storage container create \
  --name velero \
  --public-access off \
  --account-name $AZURE_STORAGE_ACCOUNT_ID

# Install Velero CLI
wget https://github.com/vmware-tanzu/velero/releases/download/v1.12.0/velero-v1.12.0-linux-amd64.tar.gz
tar -xvf velero-v1.12.0-linux-amd64.tar.gz
sudo mv velero-v1.12.0-linux-amd64/velero /usr/local/bin/

# Install Velero in cluster
velero install \
  --provider azure \
  --plugins velero/velero-plugin-for-microsoft-azure:v1.8.0 \
  --bucket velero \
  --secret-file ./credentials-velero \
  --backup-location-config resourceGroup=$AZURE_BACKUP_RESOURCE_GROUP,storageAccount=$AZURE_STORAGE_ACCOUNT_ID \
  --snapshot-location-config apiTimeout=5m,resourceGroup=$AZURE_BACKUP_RESOURCE_GROUP

# Create backup
velero backup create mybackup --include-namespaces production

# Schedule daily backups
velero schedule create daily-backup --schedule="@daily" --include-namespaces production

# Restore from backup
velero restore create --from-backup mybackup

Best Practices Summary

1. Use managed identity - Avoid service principals 2. Enable Azure RBAC - Integrate with Azure AD 3. Multiple node pools - Separate system and user workloads 4. Auto-scaling - Cluster autoscaler and HPA 5. Network policies - Restrict pod-to-pod communication 6. Private cluster - API server not publicly accessible 7. Pod security - Use Pod Security Standards 8. Resource limits - Set requests and limits on all containers 9. Health probes - Configure liveness and readiness probes 10. Monitoring - Enable Container Insights and Prometheus 11. GitOps - Use Flux or ArgoCD for deployments 12. Backup - Regular cluster and data backups

Azure Infrastructure as Code

Bicep

Bicep Overview

Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. It's a transparent abstraction over ARM templates with cleaner syntax.

Benefits:

• Simpler syntax than ARM templates
• Type safety and IntelliSense support
• Automatic dependency management
• Modular with modules and parameters
• Day-1 support for all Azure resource types

Basic Bicep Syntax

Resource Declaration:

// Storage account resource
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'mystorageaccount${uniqueString(resourceGroup().id)}'
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
  }
}

Parameters and Variables:

@description('The name of the environment')
@allowed([
  'dev'
  'staging'
  'production'
])
param environmentName string

@description('The location for all resources')
param location string = resourceGroup().location

@minValue(1)
@maxValue(10)
param instanceCount int = 2

var storageAccountName = 'st${environmentName}${uniqueString(resourceGroup().id)}'
var appServicePlanName = 'plan-${environmentName}-${location}'

Outputs:

output storageAccountId string = storageAccount.id
output storageAccountName string = storageAccount.name
output primaryEndpoints object = storageAccount.properties.primaryEndpoints

Complete Bicep Example

main.bicep:

@description('The environment name')
param environmentName string = 'dev'

@description('The location for resources')
param location string = resourceGroup().location

@description('The administrator username for the VM')
@secure()
param adminUsername string

@description('The administrator password for the VM')
@secure()
param adminPassword string

// Variables
var vnetName = 'vnet-${environmentName}'
var subnetName = 'subnet-web'
var nsgName = 'nsg-${environmentName}'
var vmName = 'vm-${environmentName}'
var nicName = '${vmName}-nic'
var publicIpName = '${vmName}-pip'

// Virtual Network
resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: vnetName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }
    subnets: [
      {
        name: subnetName
        properties: {
          addressPrefix: '10.0.1.0/24'
          networkSecurityGroup: {
            id: nsg.id
          }
        }
      }
    ]
  }
}

// Network Security Group
resource nsg 'Microsoft.Network/networkSecurityGroups@2023-05-01' = {
  name: nsgName
  location: location
  properties: {
    securityRules: [
      {
        name: 'AllowSSH'
        properties: {
          priority: 1000
          protocol: 'Tcp'
          access: 'Allow'
          direction: 'Inbound'
          sourceAddressPrefix: '*'
          sourcePortRange: '*'
          destinationAddressPrefix: '*'
          destinationPortRange: '22'
        }
      }
    ]
  }
}

// Public IP
resource publicIp 'Microsoft.Network/publicIPAddresses@2023-05-01' = {
  name: publicIpName
  location: location
  sku: {
    name: 'Standard'
  }
  properties: {
    publicIPAllocationMethod: 'Static'
    dnsSettings: {
      domainNameLabel: '${vmName}-${uniqueString(resourceGroup().id)}'
    }
  }
}

// Network Interface
resource nic 'Microsoft.Network/networkInterfaces@2023-05-01' = {
  name: nicName
  location: location
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          subnet: {
            id: vnet.properties.subnets[0].id
          }
          privateIPAllocationMethod: 'Dynamic'
          publicIPAddress: {
            id: publicIp.id
          }
        }
      }
    ]
    networkSecurityGroup: {
      id: nsg.id
    }
  }
}

// Virtual Machine
resource vm 'Microsoft.Compute/virtualMachines@2023-03-01' = {
  name: vmName
  location: location
  properties: {
    hardwareProfile: {
      vmSize: 'Standard_D2s_v5'
    }
    osProfile: {
      computerName: vmName
      adminUsername: adminUsername
      adminPassword: adminPassword
    }
    storageProfile: {
      imageReference: {
        publisher: 'Canonical'
        offer: '0001-com-ubuntu-server-jammy'
        sku: '22_04-lts-gen2'
        version: 'latest'
      }
      osDisk: {
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: 'Premium_LRS'
        }
      }
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nic.id
        }
      ]
    }
  }
}

// Outputs
output vmId string = vm.id
output publicIpAddress string = publicIp.properties.ipAddress
output fqdn string = publicIp.properties.dnsSettings.fqdn

Bicep Modules

modules/storage.bicep:

@description('Storage account name')
param storageAccountName string

@description('Location for the storage account')
param location string = resourceGroup().location

@description('Storage account SKU')
@allowed([
  'Standard_LRS'
  'Standard_GRS'
  'Standard_ZRS'
  'Premium_LRS'
])
param skuName string = 'Standard_LRS'

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  kind: 'StorageV2'
  sku: {
    name: skuName
  }
  properties: {
    accessTier: 'Hot'
    supportsHttpsTrafficOnly: true
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
    networkAcls: {
      defaultAction: 'Deny'
      bypass: 'AzureServices'
    }
  }
}

output storageAccountId string = storageAccount.id
output storageAccountName string = storageAccount.name

Using modules:

// main.bicep
module storage 'modules/storage.bicep' = {
  name: 'storageDeployment'
  params: {
    storageAccountName: 'mystorageaccount'
    location: location
    skuName: 'Standard_ZRS'
  }
}

output storageId string = storage.outputs.storageAccountId

Deploying Bicep

# Compile Bicep to ARM template (optional, automatic during deployment)
az bicep build --file main.bicep

# Deploy to resource group
az deployment group create \
  --resource-group myResourceGroup \
  --template-file main.bicep \
  --parameters environmentName=production adminUsername=azureuser

# Deploy with parameter file
az deployment group create \
  --resource-group myResourceGroup \
  --template-file main.bicep \
  --parameters @parameters.json

# What-if deployment (preview changes)
az deployment group what-if \
  --resource-group myResourceGroup \
  --template-file main.bicep \
  --parameters @parameters.json

# Deploy to subscription level
az deployment sub create \
  --location eastus \
  --template-file main.bicep

parameters.json:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "environmentName": {
      "value": "production"
    },
    "adminUsername": {
      "value": "azureuser"
    },
    "adminPassword": {
      "reference": {
        "keyVault": {
          "id": "/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.KeyVault/vaults/{vault-name}"
        },
        "secretName": "vmAdminPassword"
      }
    }
  }
}

Terraform for Azure

Azure Provider Configuration

# versions.tf
terraform {
  required_version = ">= 1.5.0"
  
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.75"
    }
  }
  
  backend "azurerm" {
    resource_group_name  = "terraform-state-rg"
    storage_account_name = "tfstatestorage"
    container_name       = "tfstate"
    key                  = "production.terraform.tfstate"
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = true
    }
    key_vault {
      purge_soft_delete_on_destroy = false
    }
  }
  
  skip_provider_registration = false
}

Resource Group and Networking

# main.tf
resource "azurerm_resource_group" "main" {
  name     = "rg-${var.environment}-${var.location}"
  location = var.location
  
  tags = var.common_tags
}

resource "azurerm_virtual_network" "main" {
  name                = "vnet-${var.environment}"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  address_space       = ["10.0.0.0/16"]
  
  tags = var.common_tags
}

resource "azurerm_subnet" "web" {
  name                 = "subnet-web"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/24"]
  
  service_endpoints = ["Microsoft.Storage", "Microsoft.Sql"]
}

resource "azurerm_subnet" "database" {
  name                 = "subnet-database"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.2.0/24"]
  
  delegation {
    name = "sql-delegation"
    
    service_delegation {
      name = "Microsoft.Sql/managedInstances"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/join/action",
      ]
    }
  }
}

resource "azurerm_network_security_group" "web" {
  name                = "nsg-web"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  
  security_rule {
    name                       = "AllowHTTPS"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
  
  tags = var.common_tags
}

resource "azurerm_subnet_network_security_group_association" "web" {
  subnet_id                 = azurerm_subnet.web.id
  network_security_group_id = azurerm_network_security_group.web.id
}

AKS Cluster

# aks.tf
resource "azurerm_kubernetes_cluster" "main" {
  name                = "aks-${var.environment}"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  dns_prefix          = "aks-${var.environment}"
  kubernetes_version  = var.kubernetes_version
  
  default_node_pool {
    name                = "system"
    node_count          = var.system_node_count
    vm_size             = "Standard_D4s_v5"
    vnet_subnet_id      = azurerm_subnet.aks.id
    enable_auto_scaling = true
    min_count           = 2
    max_count           = 5
    os_disk_size_gb     = 128
    
    upgrade_settings {
      max_surge = "33%"
    }
  }
  
  identity {
    type = "SystemAssigned"
  }
  
  network_profile {
    network_plugin    = "azure"
    network_policy    = "azure"
    load_balancer_sku = "standard"
    outbound_type     = "loadBalancer"
    
    load_balancer_profile {
      managed_outbound_ip_count = 2
    }
  }
  
  azure_active_directory_role_based_access_control {
    managed                = true
    azure_rbac_enabled     = true
    admin_group_object_ids = var.aks_admin_group_ids
  }
  
  oms_agent {
    log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id
  }
  
  key_vault_secrets_provider {
    secret_rotation_enabled = true
  }
  
  tags = var.common_tags
}

resource "azurerm_kubernetes_cluster_node_pool" "workload" {
  name                  = "workload"
  kubernetes_cluster_id = azurerm_kubernetes_cluster.main.id
  vm_size               = "Standard_D8s_v5"
  node_count            = 3
  enable_auto_scaling   = true
  min_count             = 2
  max_count             = 10
  vnet_subnet_id        = azurerm_subnet.aks.id
  
  node_labels = {
    "workload" = "application"
  }
  
  tags = var.common_tags
}

Storage Account with Private Endpoint

# storage.tf
resource "azurerm_storage_account" "main" {
  name                     = "st${var.environment}${random_string.storage_suffix.result}"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "ZRS"
  account_kind             = "StorageV2"
  access_tier              = "Hot"
  
  min_tls_version           = "TLS1_2"
  enable_https_traffic_only = true
  allow_nested_items_to_be_public = false
  
  network_rules {
    default_action = "Deny"
    bypass         = ["AzureServices"]
  }
  
  blob_properties {
    versioning_enabled  = true
    change_feed_enabled = true
    
    delete_retention_policy {
      days = 30
    }
    
    container_delete_retention_policy {
      days = 30
    }
  }
  
  tags = var.common_tags
}

resource "random_string" "storage_suffix" {
  length  = 8
  special = false
  upper   = false
}

resource "azurerm_private_endpoint" "storage_blob" {
  name                = "pe-${azurerm_storage_account.main.name}-blob"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  subnet_id           = azurerm_subnet.private_endpoints.id
  
  private_service_connection {
    name                           = "psc-${azurerm_storage_account.main.name}-blob"
    private_connection_resource_id = azurerm_storage_account.main.id
    is_manual_connection           = false
    subresource_names              = ["blob"]
  }
  
  private_dns_zone_group {
    name                 = "default"
    private_dns_zone_ids = [azurerm_private_dns_zone.storage_blob.id]
  }
  
  tags = var.common_tags
}

resource "azurerm_private_dns_zone" "storage_blob" {
  name                = "privatelink.blob.core.windows.net"
  resource_group_name = azurerm_resource_group.main.name
  
  tags = var.common_tags
}

resource "azurerm_private_dns_zone_virtual_network_link" "storage_blob" {
  name                  = "vnet-link-${azurerm_virtual_network.main.name}"
  resource_group_name   = azurerm_resource_group.main.name
  private_dns_zone_name = azurerm_private_dns_zone.storage_blob.name
  virtual_network_id    = azurerm_virtual_network.main.id
  
  tags = var.common_tags
}

Variables and Outputs

# variables.tf
variable "environment" {
  description = "Environment name"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "Environment must be dev, staging, or production."
  }
}

variable "location" {
  description = "Azure region"
  type        = string
  default     = "eastus"
}

variable "common_tags" {
  description = "Common tags for all resources"
  type        = map(string)
  default = {
    ManagedBy = "Terraform"
    Project   = "MyProject"
  }
}

variable "kubernetes_version" {
  description = "Kubernetes version"
  type        = string
  default     = "1.28"
}

# outputs.tf
output "resource_group_name" {
  description = "Resource group name"
  value       = azurerm_resource_group.main.name
}

output "aks_cluster_name" {
  description = "AKS cluster name"
  value       = azurerm_kubernetes_cluster.main.name
}

output "aks_cluster_id" {
  description = "AKS cluster ID"
  value       = azurerm_kubernetes_cluster.main.id
}

output "aks_kube_config" {
  description = "Kubernetes configuration"
  value       = azurerm_kubernetes_cluster.main.kube_config_raw
  sensitive   = true
}

output "storage_account_name" {
  description = "Storage account name"
  value       = azurerm_storage_account.main.name
}

Terraform Commands

# Initialize Terraform
terraform init

# Format code
terraform fmt -recursive

# Validate configuration
terraform validate

# Plan deployment
terraform plan -out=tfplan

# Apply deployment
terraform apply tfplan

# Show current state
terraform show

# List resources
terraform state list

# Import existing resource
terraform import azurerm_resource_group.main /subscriptions/{subscription-id}/resourceGroups/myResourceGroup

# Destroy resources
terraform destroy

Azure CLI Scripts

Automation Script Examples

#!/bin/bash
# deploy-infrastructure.sh

set -e  # Exit on error

RESOURCE_GROUP="rg-production"
LOCATION="eastus"
ENVIRONMENT="production"

# Function to log messages
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
}

# Create resource group
log "Creating resource group..."
az group create \
    --name "$RESOURCE_GROUP" \
    --location "$LOCATION" \
    --tags Environment="$ENVIRONMENT" ManagedBy="Script"

# Deploy VNet
log "Deploying virtual network..."
az network vnet create \
    --resource-group "$RESOURCE_GROUP" \
    --name "vnet-$ENVIRONMENT" \
    --address-prefix 10.0.0.0/16 \
    --subnet-name subnet-web \
    --subnet-prefix 10.0.1.0/24

# Deploy AKS
log "Deploying AKS cluster..."
az aks create \
    --resource-group "$RESOURCE_GROUP" \
    --name "aks-$ENVIRONMENT" \
    --node-count 3 \
    --enable-managed-identity \
    --network-plugin azure \
    --enable-addons monitoring \
    --generate-ssh-keys

# Get AKS credentials
log "Getting AKS credentials..."
az aks get-credentials \
    --resource-group "$RESOURCE_GROUP" \
    --name "aks-$ENVIRONMENT" \
    --overwrite-existing

log "Deployment completed successfully!"

Azure PowerShell

# Deploy-Infrastructure.ps1

param(
    [Parameter(Mandatory=$true)]
    [ValidateSet("dev","staging","production")]
    [string]$Environment,
    
    [Parameter(Mandatory=$true)]
    [string]$Location = "eastus"
)

$ErrorActionPreference = "Stop"

function Write-Log {
    param([string]$Message)
    Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
}

$resourceGroupName = "rg-$Environment"

# Create resource group
Write-Log "Creating resource group..."
New-AzResourceGroup `
    -Name $resourceGroupName `
    -Location $Location `
    -Tag @{Environment=$Environment; ManagedBy="PowerShell"}

# Deploy AKS
Write-Log "Deploying AKS cluster..."
New-AzAksCluster `
    -ResourceGroupName $resourceGroupName `
    -Name "aks-$Environment" `
    -NodeCount 3 `
    -NetworkPlugin azure `
    -EnableManagedIdentity `
    -GenerateSshKey

Write-Log "Deployment completed successfully!"

Azure Monitoring and Diagnostics

Azure Monitor Overview

Azure Monitor collects, analyzes, and acts on telemetry data from Azure and on-premises environments.

Key Components:

• Metrics: Numerical time-series data
• Logs: Event and diagnostic data
• Application Insights: Application performance monitoring
• Log Analytics: Query and analyze log data
• Alerts: Proactive notifications
• Dashboards: Visualize monitoring data

Log Analytics Workspace

Creating Workspace

# Create Log Analytics workspace
az monitor log-analytics workspace create \
  --resource-group myResourceGroup \
  --workspace-name myWorkspace \
  --location eastus \
  --retention-time 90 \
  --sku PerGB2018

# Get workspace ID and key
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group myResourceGroup \
  --workspace-name myWorkspace \
  --query customerId -o tsv)

WORKSPACE_KEY=$(az monitor log-analytics workspace get-shared-keys \
  --resource-group myResourceGroup \
  --workspace-name myWorkspace \
  --query primarySharedKey -o tsv)

KQL (Kusto Query Language) Queries

// Query all logs from last 24 hours
AzureActivity
| where TimeGenerated > ago(24h)
| project TimeGenerated, OperationName, ResourceProvider, ResourceId
| limit 100

// Count operations by resource provider
AzureActivity
| where TimeGenerated > ago(7d)
| summarize Count = count() by ResourceProvider
| order by Count desc

// Failed requests in Application Insights
requests
| where success == false
| where timestamp > ago(1h)
| project timestamp, name, url, resultCode, duration
| order by timestamp desc

// Performance counters
Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| render timechart

// Container CPU usage
Perf
| where ObjectName == "K8SContainer" and CounterName == "cpuUsageNanoCores"
| where TimeGenerated > ago(1h)
| extend CPU = CounterValue / 1000000000
| summarize avg(CPU) by bin(TimeGenerated, 5m), InstanceName
| render timechart

// Security events
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625  // Failed logon
| summarize Count = count() by Account, IpAddress
| order by Count desc
| take 20

// Storage account operations
StorageBlobLogs
| where TimeGenerated > ago(1h)
| where StatusCode != 200
| project TimeGenerated, OperationName, StatusCode, Uri, CallerIpAddress
| order by TimeGenerated desc

// AKS logs
ContainerLog
| where TimeGenerated > ago(1h)
| where Namespace == "production"
| project TimeGenerated, Computer, ContainerName, LogEntry
| order by TimeGenerated desc

Running Queries

# Run query from CLI
az monitor log-analytics query \
  --workspace $WORKSPACE_ID \
  --analytics-query "AzureActivity | where TimeGenerated > ago(1h) | limit 10" \
  --output table

# Save query for reuse
az monitor log-analytics workspace saved-search create \
  --resource-group myResourceGroup \
  --workspace-name myWorkspace \
  --name "Failed Requests" \
  --category "Application" \
  --query "requests | where success == false | where timestamp > ago(1h)"

Application Insights

Creating Application Insights

# Create Application Insights
az monitor app-insights component create \
  --app myAppInsights \
  --location eastus \
  --resource-group myResourceGroup \
  --application-type web \
  --kind web \
  --workspace $WORKSPACE_ID

# Get instrumentation key
INSTRUMENTATION_KEY=$(az monitor app-insights component show \
  --app myAppInsights \
  --resource-group myResourceGroup \
  --query instrumentationKey -o tsv)

# Get connection string
CONNECTION_STRING=$(az monitor app-insights component show \
  --app myAppInsights \
  --resource-group myResourceGroup \
  --query connectionString -o tsv)

Instrumenting Applications

Node.js:

// Import Application Insights
const appInsights = require('applicationinsights');

// Initialize with connection string
appInsights.setup(process.env.APPLICATIONINSIGHTS_CONNECTION_STRING)
  .setAutoDependencyCorrelation(true)
  .setAutoCollectRequests(true)
  .setAutoCollectPerformance(true, true)
  .setAutoCollectExceptions(true)
  .setAutoCollectDependencies(true)
  .setAutoCollectConsole(true)
  .setUseDiskRetryCaching(true)
  .setSendLiveMetrics(true)
  .start();

// Get telemetry client
const client = appInsights.defaultClient;

// Track custom events
client.trackEvent({ name: "UserLogin", properties: { userId: "123" } });

// Track custom metrics
client.trackMetric({ name: "OrderValue", value: 299.99 });

// Track dependencies
client.trackDependency({
  target: "https://api.example.com",
  name: "GET /users",
  data: "GET /users",
  duration: 150,
  resultCode: 200,
  success: true,
  dependencyTypeName: "HTTP"
});

Python:

from applicationinsights import TelemetryClient
from applicationinsights.flask.ext import AppInsights

# Flask application
app = Flask(__name__)
app.config['APPINSIGHTS_INSTRUMENTATIONKEY'] = os.getenv('APPINSIGHTS_INSTRUMENTATIONKEY')
appinsights = AppInsights(app)

# Standalone client
tc = TelemetryClient(instrumentation_key)

# Track events
tc.track_event('UserLogin', {'userId': '123'})

# Track metrics
tc.track_metric('OrderValue', 299.99)

# Track exceptions
try:
    result = 1 / 0
except Exception as e:
    tc.track_exception()

tc.flush()

.NET:

using Microsoft.ApplicationInsights;
using Microsoft.ApplicationInsights.Extensibility;

// Create telemetry client
var config = TelemetryConfiguration.CreateDefault();
config.ConnectionString = Environment.GetEnvironmentVariable("APPLICATIONINSIGHTS_CONNECTION_STRING");
var client = new TelemetryClient(config);

// Track events
client.TrackEvent("UserLogin", new Dictionary<string, string> { { "userId", "123" } });

// Track metrics
client.TrackMetric("OrderValue", 299.99);

// Track dependencies
client.TrackDependency("SQL", "GetUser", "SELECT * FROM Users", DateTimeOffset.Now, TimeSpan.FromMilliseconds(150), true);

Availability Tests

# Create availability test
az monitor app-insights web-test create \
  --resource-group myResourceGroup \
  --name myAvailabilityTest \
  --location eastus \
  --web-test-kind ping \
  --frequency 300 \
  --timeout 30 \
  --enabled true \
  --locations "us-va-ash-azr" "us-ca-sjc-azr" \
  --geo-locations "East US" "West US" \
  --retry-enabled true \
  --test-url "https://myapp.example.com/health" \
  --defined-web-test-name myAppInsights

Diagnostic Settings

Enabling Diagnostics

# Enable diagnostics for storage account
az monitor diagnostic-settings create \
  --name storage-diagnostics \
  --resource /subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount \
  --workspace $WORKSPACE_ID \
  --logs '[
    {
      "category": "StorageRead",
      "enabled": true,
      "retentionPolicy": { "enabled": true, "days": 30 }
    },
    {
      "category": "StorageWrite",
      "enabled": true,
      "retentionPolicy": { "enabled": true, "days": 30 }
    }
  ]' \
  --metrics '[
    {
      "category": "Transaction",
      "enabled": true,
      "retentionPolicy": { "enabled": true, "days": 30 }
    }
  ]'

# Enable diagnostics for AKS
az aks enable-addons \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --addons monitoring \
  --workspace-resource-id $WORKSPACE_ID

# Enable diagnostics for Key Vault
az monitor diagnostic-settings create \
  --name keyvault-diagnostics \
  --resource /subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.KeyVault/vaults/myKeyVault \
  --workspace $WORKSPACE_ID \
  --logs '[
    {
      "category": "AuditEvent",
      "enabled": true,
      "retentionPolicy": { "enabled": true, "days": 90 }
    }
  ]' \
  --metrics '[
    {
      "category": "AllMetrics",
      "enabled": true,
      "retentionPolicy": { "enabled": true, "days": 30 }
    }
  ]'

Metrics and Alerts

Viewing Metrics

# Get VM CPU metrics
az monitor metrics list \
  --resource /subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM \
  --metric "Percentage CPU" \
  --start-time 2024-01-01T00:00:00Z \
  --end-time 2024-01-01T23:59:59Z \
  --interval PT1H \
  --output table

# Get storage account metrics
az monitor metrics list \
  --resource /subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount \
  --metric "UsedCapacity" \
  --output table

Creating Alerts

# Create action group for notifications
az monitor action-group create \
  --resource-group myResourceGroup \
  --name devops-team \
  --short-name devops \
  --email-receiver name=admin email=admin@example.com \
  --sms-receiver name=oncall countrycode=1 phonenumber=5551234567 \
  --webhook-receiver name=slack service-uri=https://hooks.slack.com/services/xxx/yyy/zzz

# Create metric alert for high CPU
az monitor metrics alert create \
  --name high-cpu-alert \
  --resource-group myResourceGroup \
  --scopes /subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM \
  --condition "avg Percentage CPU > 80" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --action devops-team \
  --description "Alert when CPU usage exceeds 80%"

# Create log alert
az monitor scheduled-query create \
  --name failed-requests-alert \
  --resource-group myResourceGroup \
  --scopes $WORKSPACE_ID \
  --condition "count 'requests | where success == false' > 10" \
  --window-size 5m \
  --evaluation-frequency 5m \
  --action devops-team \
  --description "Alert when failed requests exceed 10 in 5 minutes"

# Create activity log alert
az monitor activity-log alert create \
  --resource-group myResourceGroup \
  --name vm-stopped-alert \
  --description "Alert when VM is stopped" \
  --scopes /subscriptions/{sub-id}/resourceGroups/myResourceGroup \
  --condition category=Administrative and operationName=Microsoft.Compute/virtualMachines/deallocate/action \
  --action-groups devops-team

Dashboards

Creating Dashboard

// dashboard.json
{
  "properties": {
    "lenses": [
      {
        "order": 0,
        "parts": [
          {
            "position": {
              "x": 0,
              "y": 0,
              "rowSpan": 4,
              "colSpan": 6
            },
            "metadata": {
              "type": "Extension/Microsoft_Azure_Monitoring/PartType/MetricsChartPart",
              "settings": {
                "content": {
                  "options": {
                    "chart": {
                      "metrics": [
                        {
                          "resourceMetadata": {
                            "id": "/subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM"
                          },
                          "name": "Percentage CPU",
                          "aggregationType": 4,
                          "namespace": "Microsoft.Compute/virtualMachines"
                        }
                      ],
                      "title": "VM CPU Usage",
                      "titleKind": 1,
                      "visualization": {
                        "chartType": 2
                      }
                    }
                  }
                }
              }
            }
          }
        ]
      }
    ],
    "metadata": {
      "model": {
        "timeRange": {
          "type": "MsPortalFx.Composition.Configuration.ValueTypes.TimeRange",
          "value": {
            "relative": {
              "duration": 24,
              "timeUnit": 1
            }
          }
        }
      }
    }
  },
  "name": "Production Dashboard",
  "type": "Microsoft.Portal/dashboards",
  "location": "eastus",
  "tags": {
    "hidden-title": "Production Dashboard"
  }
}

# Create dashboard
az portal dashboard create \
  --resource-group myResourceGroup \
  --name production-dashboard \
  --location eastus \
  --input-path dashboard.json

Workbooks

Creating Workbook

# Create workbook for application monitoring
az monitor app-insights workbook create \
  --resource-group myResourceGroup \
  --name app-monitoring \
  --location eastus \
  --display-name "Application Monitoring" \
  --category workbook \
  --serialized-data @workbook.json

Container Insights

Monitoring AKS

# Enable Container Insights
az aks enable-addons \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --addons monitoring \
  --workspace-resource-id $WORKSPACE_ID

# Query container logs
az monitor log-analytics query \
  --workspace $WORKSPACE_ID \
  --analytics-query "
    ContainerLog
    | where TimeGenerated > ago(1h)
    | where Name contains 'myapp'
    | project TimeGenerated, Computer, Name, LogEntry
  " \
  --output table

# Query container performance
az monitor log-analytics query \
  --workspace $WORKSPACE_ID \
  --analytics-query "
    Perf
    | where TimeGenerated > ago(1h)
    | where ObjectName == 'K8SContainer'
    | where CounterName == 'cpuUsageNanoCores'
    | summarize avg(CounterValue) by InstanceName, bin(TimeGenerated, 5m)
  " \
  --output table

Network Monitoring

Network Watcher

# Enable Network Watcher
az network watcher configure \
  --resource-group NetworkWatcherRG \
  --locations eastus \
  --enabled true

# Test IP flow
az network watcher test-ip-flow \
  --resource-group myResourceGroup \
  --vm myVM \
  --direction Outbound \
  --protocol TCP \
  --local 10.0.0.4:80 \
  --remote 20.30.40.50:443

# Next hop analysis
az network watcher show-next-hop \
  --resource-group myResourceGroup \
  --vm myVM \
  --source-ip 10.0.0.4 \
  --dest-ip 20.30.40.50

# Packet capture
az network watcher packet-capture create \
  --resource-group myResourceGroup \
  --vm myVM \
  --name myCapture \
  --storage-account mystorageaccount \
  --filters "[{\"protocol\":\"TCP\",\"localPort\":\"80\"}]" \
  --time-limit 60

Connection Monitor

# Create connection monitor
az network watcher connection-monitor create \
  --resource-group myResourceGroup \
  --name myConnectionMonitor \
  --location eastus \
  --endpoint-source-resource-id /subscriptions/{sub-id}/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM \
  --endpoint-dest-address www.example.com \
  --endpoint-dest-port 443 \
  --test-config-protocol Tcp \
  --test-config-test-frequency-sec 60

Flow Logs

# Enable NSG flow logs
az network watcher flow-log create \
  --resource-group myResourceGroup \
  --name myFlowLog \
  --nsg myNSG \
  --storage-account mystorageaccount \
  --enabled true \
  --retention 90 \
  --traffic-analytics true \
  --workspace $WORKSPACE_ID

Cost Monitoring

# Get cost and usage data
az consumption usage list \
  --start-date 2024-01-01 \
  --end-date 2024-01-31 \
  --output table

# Create budget
az consumption budget create \
  --resource-group myResourceGroup \
  --budget-name monthly-budget \
  --amount 1000 \
  --category Cost \
  --time-grain Monthly \
  --start-date 2024-01-01T00:00:00Z \
  --end-date 2024-12-31T23:59:59Z \
  --notifications '[
    {
      "enabled": true,
      "operator": "GreaterThan",
      "threshold": 80,
      "contactEmails": ["admin@example.com"],
      "contactRoles": ["Owner"]
    }
  ]'

Best Practices

1. Enable diagnostics on all resources - Capture logs and metrics 2. Use Log Analytics workspace - Centralize log data 3. Create meaningful alerts - Actionable, not noisy 4. Implement availability tests - Monitor application uptime 5. Use Application Insights - Track application performance 6. Configure action groups - Multiple notification channels 7. Create dashboards - Visualize key metrics 8. Set up cost alerts - Monitor spending 9. Enable Network Watcher - Troubleshoot network issues 10. Regular review of metrics - Optimize performance and costs

Azure Security Configuration

Azure Active Directory (Entra ID)

User and Group Management

# Create user
az ad user create \
  --display-name "John Doe" \
  --user-principal-name john.doe@contoso.com \
  --password "SecurePassword123!" \
  --force-change-password-next-sign-in true

# Create security group
az ad group create \
  --display-name "DevOps Engineers" \
  --mail-nickname devops \
  --description "DevOps team members"

# Add user to group
az ad group member add \
  --group "DevOps Engineers" \
  --member-id {USER_OBJECT_ID}

# List group members
az ad group member list \
  --group "DevOps Engineers" \
  --output table

Service Principals

# Create service principal for app
az ad sp create-for-rbac \
  --name myApplication \
  --role Contributor \
  --scopes /subscriptions/{subscription-id}/resourceGroups/myResourceGroup

# Create service principal with certificate
az ad sp create-for-rbac \
  --name myApplication \
  --role Contributor \
  --scopes /subscriptions/{subscription-id} \
  --create-cert

# Reset credentials
az ad sp credential reset \
  --id {APP_ID}

# Delete service principal
az ad sp delete --id {APP_ID}

Managed Identities

System-Assigned Managed Identity

# Enable system-assigned identity on VM
az vm identity assign \
  --resource-group myResourceGroup \
  --name myVM

# Enable on App Service
az webapp identity assign \
  --resource-group myResourceGroup \
  --name myWebApp

# Enable on AKS
az aks update \
  --resource-group myResourceGroup \
  --name myAKSCluster \
  --enable-managed-identity

User-Assigned Managed Identity

# Create user-assigned identity
az identity create \
  --resource-group myResourceGroup \
  --name myUserAssignedIdentity

# Get identity details
IDENTITY_ID=$(az identity show \
  --resource-group myResourceGroup \
  --name myUserAssignedIdentity \
  --query id -o tsv)

IDENTITY_PRINCIPAL_ID=$(az identity show \
  --resource-group myResourceGroup \
  --name myUserAssignedIdentity \
  --query principalId -o tsv)

# Assign identity to VM
az vm identity assign \
  --resource-group myResourceGroup \
  --name myVM \
  --identities $IDENTITY_ID

# Assign identity to App Service
az webapp identity assign \
  --resource-group myResourceGroup \
  --name myWebApp \
  --identities $IDENTITY_ID

Role-Based Access Control (RBAC)

Built-in Roles

# List built-in roles
az role definition list --output table

# Show role definition
az role definition list --name "Contributor" --output json

# Common built-in roles:
# - Owner: Full access including access management
# - Contributor: Full access except access management
# - Reader: View only access
# - User Access Administrator: Manage user access only
# - Kubernetes roles: Azure Kubernetes Service RBAC Admin, Cluster Admin, etc.

Role Assignments

# Assign role to user at subscription level
az role assignment create \
  --assignee user@contoso.com \
  --role "Contributor" \
  --scope /subscriptions/{subscription-id}

# Assign role to group at resource group level
az role assignment create \
  --assignee-object-id {GROUP_OBJECT_ID} \
  --assignee-principal-type Group \
  --role "Reader" \
  --resource-group myResourceGroup

# Assign role to managed identity
az role assignment create \
  --assignee $IDENTITY_PRINCIPAL_ID \
  --role "Storage Blob Data Contributor" \
  --scope /subscriptions/{subscription-id}/resourceGroups/myResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount

# List role assignments
az role assignment list \
  --assignee user@contoso.com \
  --output table

# Remove role assignment
az role assignment delete \
  --assignee user@contoso.com \
  --role "Contributor" \
  --resource-group myResourceGroup

Custom Roles

// custom-role.json
{
  "Name": "Virtual Machine Operator",
  "IsCustom": true,
  "Description": "Can monitor and restart virtual machines",
  "Actions": [
    "Microsoft.Compute/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Support/*"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/{subscription-id}"
  ]
}

# Create custom role
az role definition create --role-definition custom-role.json

# Update custom role
az role definition update --role-definition custom-role.json

# Delete custom role
az role definition delete --name "Virtual Machine Operator"

Azure Key Vault

Creating Key Vault

# Create Key Vault
az keyvault create \
  --name myKeyVault \
  --resource-group myResourceGroup \
  --location eastus \
  --enable-rbac-authorization false \
  --enable-soft-delete true \
  --soft-delete-retention-days 90 \
  --enable-purge-protection true

# Set access policy for user
az keyvault set-policy \
  --name myKeyVault \
  --upn user@contoso.com \
  --secret-permissions get list set delete \
  --key-permissions get list create delete \
  --certificate-permissions get list create delete

# Set access policy for managed identity
az keyvault set-policy \
  --name myKeyVault \
  --object-id $IDENTITY_PRINCIPAL_ID \
  --secret-permissions get list

Managing Secrets

# Create secret
az keyvault secret set \
  --vault-name myKeyVault \
  --name database-connection-string \
  --value "Server=myserver;Database=mydb;User=admin;Password=SecurePass123!"

# Get secret
az keyvault secret show \
  --vault-name myKeyVault \
  --name database-connection-string \
  --query value -o tsv

# List secrets
az keyvault secret list \
  --vault-name myKeyVault \
  --output table

# Delete secret (soft delete)
az keyvault secret delete \
  --vault-name myKeyVault \
  --name database-connection-string

# Recover deleted secret
az keyvault secret recover \
  --vault-name myKeyVault \
  --name database-connection-string

# Purge deleted secret (permanent)
az keyvault secret purge \
  --vault-name myKeyVault \
  --name database-connection-string

# Set expiration date
az keyvault secret set \
  --vault-name myKeyVault \
  --name temp-secret \
  --value "temporary" \
  --expires "2024-12-31T23:59:59Z"

Managing Keys

# Create key
az keyvault key create \
  --vault-name myKeyVault \
  --name myKey \
  --kty RSA \
  --size 4096 \
  --ops encrypt decrypt sign verify wrapKey unwrapKey

# Import key
az keyvault key import \
  --vault-name myKeyVault \
  --name imported-key \
  --pem-file key.pem

# Backup key
az keyvault key backup \
  --vault-name myKeyVault \
  --name myKey \
  --file key-backup.blob

# Restore key
az keyvault key restore \
  --vault-name myKeyVault \
  --file key-backup.blob

Managing Certificates

# Create self-signed certificate
az keyvault certificate create \
  --vault-name myKeyVault \
  --name myCertificate \
  --policy @policy.json

# policy.json
cat > policy.json << EOF
{
  "issuerParameters": {
    "name": "Self"
  },
  "keyProperties": {
    "exportable": true,
    "keySize": 2048,
    "keyType": "RSA",
    "reuseKey": false
  },
  "x509CertificateProperties": {
    "subject": "CN=myapp.contoso.com",
    "validityInMonths": 12,
    "subjectAlternativeNames": {
      "dnsNames": [
        "myapp.contoso.com",
        "www.myapp.contoso.com"
      ]
    }
  }
}
EOF

# Download certificate
az keyvault certificate download \
  --vault-name myKeyVault \
  --name myCertificate \
  --file certificate.crt

# Import certificate from Let's Encrypt or CA
az keyvault certificate import \
  --vault-name myKeyVault \
  --name imported-cert \
  --file certificate.pfx \
  --password "password"

Network Security Groups (NSGs)

Creating NSG Rules

# Create NSG
az network nsg create \
  --resource-group myResourceGroup \
  --name myNSG \
  --location eastus

# Add inbound rule to allow HTTPS
az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name AllowHTTPS \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes '*' \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges 443

# Add rule to allow SSH from specific IP
az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name AllowSSHFromOffice \
  --priority 110 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --source-address-prefixes '203.0.113.0/24' \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges 22

# Deny all other inbound traffic
az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name DenyAllInbound \
  --priority 4096 \
  --direction Inbound \
  --access Deny \
  --protocol '*' \
  --source-address-prefixes '*' \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges '*'

# Associate NSG with subnet
az network vnet subnet update \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --name mySubnet \
  --network-security-group myNSG

# List NSG rules
az network nsg rule list \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --output table

Azure Firewall

Deploying Azure Firewall

# Create Azure Firewall subnet
az network vnet subnet create \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --name AzureFirewallSubnet \
  --address-prefix 10.0.100.0/26

# Create public IP for firewall
az network public-ip create \
  --resource-group myResourceGroup \
  --name fw-public-ip \
  --sku Standard \
  --allocation-method Static

# Create Azure Firewall
az network firewall create \
  --resource-group myResourceGroup \
  --name myFirewall \
  --location eastus \
  --enable-dns-proxy true

# Create firewall IP configuration
az network firewall ip-config create \
  --firewall-name myFirewall \
  --name fw-config \
  --public-ip-address fw-public-ip \
  --resource-group myResourceGroup \
  --vnet-name myVNet

# Create application rule collection
az network firewall application-rule create \
  --resource-group myResourceGroup \
  --firewall-name myFirewall \
  --collection-name app-rules \
  --priority 200 \
  --action Allow \
  --name AllowWindowsUpdate \
  --protocols Http=80 Https=443 \
  --source-addresses '*' \
  --target-fqdns '*.microsoft.com' '*.windows.net'

# Create network rule collection
az network firewall network-rule create \
  --resource-group myResourceGroup \
  --firewall-name myFirewall \
  --collection-name net-rules \
  --priority 300 \
  --action Allow \
  --name AllowDNS \
  --protocols UDP \
  --source-addresses '*' \
  --destination-addresses '*' \
  --destination-ports 53

Azure Policy

Built-in Policies

# List policy definitions
az policy definition list --output table

# Show policy definition
az policy definition show \
  --name '06a78e20-9358-41c9-923c-fb736d382a4d' # Audit VMs without managed disks

# Assign policy at subscription level
az policy assignment create \
  --name 'audit-vm-managed-disks' \
  --display-name 'Audit VMs without managed disks' \
  --scope /subscriptions/{subscription-id} \
  --policy '06a78e20-9358-41c9-923c-fb736d382a4d'

# Assign policy at resource group level
az policy assignment create \
  --name 'require-tags' \
  --display-name 'Require tags on resources' \
  --scope /subscriptions/{subscription-id}/resourceGroups/myResourceGroup \
  --policy '871b6d14-10aa-478d-b590-94f262ecfa99' \
  --params '{ "tagName": { "value": "Environment" } }'

# List policy assignments
az policy assignment list --output table

# Check compliance
az policy state list \
  --resource-group myResourceGroup \
  --output table

Custom Policy

// custom-policy.json
{
  "properties": {
    "displayName": "Require specific tags",
    "policyType": "Custom",
    "mode": "Indexed",
    "description": "Enforces required tags on resources",
    "metadata": {
      "category": "Tags"
    },
    "parameters": {
      "tagName": {
        "type": "String",
        "metadata": {
          "displayName": "Tag Name",
          "description": "Name of the tag, such as 'Environment'"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "[concat('tags[', parameters('tagName'), ']')]",
        "exists": "false"
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

# Create custom policy definition
az policy definition create \
  --name 'require-specific-tags' \
  --display-name 'Require specific tags' \
  --rules 'custom-policy.json' \
  --mode Indexed

# Assign custom policy
az policy assignment create \
  --name 'enforce-tags' \
  --display-name 'Enforce required tags' \
  --scope /subscriptions/{subscription-id}/resourceGroups/myResourceGroup \
  --policy 'require-specific-tags' \
  --params '{ "tagName": { "value": "CostCenter" } }'

Azure Security Center / Defender for Cloud

# Enable Defender for Cloud
az security pricing create \
  --name VirtualMachines \
  --tier Standard

az security pricing create \
  --name SqlServers \
  --tier Standard

az security pricing create \
  --name AppServices \
  --tier Standard

az security pricing create \
  --name StorageAccounts \
  --tier Standard

az security pricing create \
  --name KubernetesService \
  --tier Standard

# List security assessments
az security assessment list --output table

# Get security score
az security secure-score-controls list --output table

# Enable auto-provisioning
az security auto-provisioning-setting update \
  --auto-provision On \
  --name default

Encryption Best Practices

Disk Encryption

# Enable Azure Disk Encryption
az vm encryption enable \
  --resource-group myResourceGroup \
  --name myVM \
  --disk-encryption-keyvault myKeyVault \
  --volume-type all

# Check encryption status
az vm encryption show \
  --resource-group myResourceGroup \
  --name myVM

Storage Encryption

# Enable infrastructure encryption (double encryption)
az storage account create \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --location eastus \
  --sku Standard_ZRS \
  --encryption-services blob file \
  --require-infrastructure-encryption true

# Use customer-managed key
az storage account update \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --encryption-key-source Microsoft.Keyvault \
  --encryption-key-vault https://mykeyvault.vault.azure.net \
  --encryption-key-name mykey \
  --encryption-key-version {version}

Security Checklist

1. Identity and Access

• ✓ Enable Azure AD Multi-Factor Authentication
• ✓ Use managed identities instead of credentials
• ✓ Implement RBAC with least privilege
• ✓ Regular review of role assignments
• ✓ Disable local accounts where possible

2. Network Security

• ✓ Use private endpoints for Azure services
• ✓ Implement NSGs with explicit allow rules
• ✓ Deploy Azure Firewall for centralized security
• ✓ Enable DDoS Protection Standard
• ✓ Use service endpoints for Azure services

3. Data Protection

• ✓ Enable encryption at rest and in transit
• ✓ Use Azure Key Vault for secrets management
• ✓ Enable soft delete and purge protection
• ✓ Implement backup and disaster recovery
• ✓ Use customer-managed keys for sensitive data

4. Monitoring and Compliance

• ✓ Enable Azure Security Center/Defender
• ✓ Configure Azure Policy for governance
• ✓ Enable diagnostic logging on all resources
• ✓ Set up alerts for security events
• ✓ Regular security assessments and audits

5. Application Security

• ✓ Use Web Application Firewall (WAF)
• ✓ Enable Application Insights
• ✓ Implement certificate management
• ✓ Use Key Vault references in App Service
• ✓ Scan container images for vulnerabilities

Azure Storage Solutions

Azure Blob Storage

Storage Account Types

Performance Tiers:

• Standard: General-purpose, cost-effective, backed by HDDs
• Premium: High-performance, backed by SSDs, low latency

Account Kinds:

• StorageV2 (General-purpose v2): Recommended for most scenarios
• BlobStorage: Legacy, blob-only accounts
• BlockBlobStorage: Premium block blobs and append blobs
• FileStorage: Premium file shares

Access Tiers

Hot Tier

• Optimized for frequent access
• Higher storage costs, lower access costs
• Use for active data

Cool Tier

• Optimized for infrequent access (stored 30+ days)
• Lower storage costs, higher access costs
• Use for short-term backup and archives

Archive Tier

• Lowest storage costs, highest access costs
• Hours of latency for retrieval
• Use for long-term archival (stored 180+ days)

Creating Storage Account

# Create storage account with best practices
az storage account create \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --location eastus \
  --sku Standard_ZRS \
  --kind StorageV2 \
  --access-tier Hot \
  --https-only true \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --default-action Deny \
  --bypass AzureServices

# Enable soft delete for blobs
az storage blob service-properties delete-policy update \
  --account-name mystorageaccount \
  --enable true \
  --days-retained 30

# Enable versioning
az storage account blob-service-properties update \
  --account-name mystorageaccount \
  --resource-group myResourceGroup \
  --enable-versioning true

Blob Operations

# Upload blob
az storage blob upload \
  --account-name mystorageaccount \
  --container-name mycontainer \
  --name myblob.txt \
  --file ./local-file.txt \
  --auth-mode login

# Set blob tier
az storage blob set-tier \
  --account-name mystorageaccount \
  --container-name mycontainer \
  --name myblob.txt \
  --tier Cool

# Copy blob between containers
az storage blob copy start \
  --account-name mystorageaccount \
  --destination-blob dest-blob.txt \
  --destination-container dest-container \
  --source-container source-container \
  --source-blob source-blob.txt

# Generate SAS token
az storage blob generate-sas \
  --account-name mystorageaccount \
  --container-name mycontainer \
  --name myblob.txt \
  --permissions r \
  --expiry 2024-12-31T23:59Z \
  --https-only

Lifecycle Management

{
  "rules": [
    {
      "name": "moveToCool",
      "enabled": true,
      "type": "Lifecycle",
      "definition": {
        "filters": {
          "blobTypes": ["blockBlob"],
          "prefixMatch": ["logs/"]
        },
        "actions": {
          "baseBlob": {
            "tierToCool": {
              "daysAfterModificationGreaterThan": 30
            },
            "tierToArchive": {
              "daysAfterModificationGreaterThan": 90
            },
            "delete": {
              "daysAfterModificationGreaterThan": 365
            }
          }
        }
      }
    }
  ]
}

Immutable Storage (WORM)

# Enable immutability policy
az storage container immutability-policy create \
  --account-name mystorageaccount \
  --container-name compliance-container \
  --period 2555 \
  --resource-group myResourceGroup

# Enable legal hold
az storage container legal-hold set \
  --account-name mystorageaccount \
  --container-name compliance-container \
  --tags audit investigation

Azure Files

File Share Tiers

Premium (FileStorage account)

• SSD-backed, low latency
• Provisioned model (pay for provisioned size)
• Up to 100,000 IOPS per share
• Use for high-performance workloads

Transaction Optimized (Standard)

• HDD-backed
• Pay for used storage + transactions
• Use for general-purpose workloads

Hot/Cool (Standard)

• Cost-optimized tiers
• Lower storage costs than transaction optimized
• Use based on access patterns

Creating File Share

# Create file share
az storage share create \
  --account-name mystorageaccount \
  --name myfileshare \
  --quota 1024 \
  --enabled-protocols SMB

# Create NFS file share (Premium only)
az storage share create \
  --account-name mypremiumstorage \
  --name mynfsshare \
  --enabled-protocols NFS \
  --quota 100

Mounting File Shares

Windows:

$connectTestResult = Test-NetConnection -ComputerName mystorageaccount.file.core.windows.net -Port 445
if ($connectTestResult.TcpTestSucceeded) {
    cmd.exe /C "cmdkey /add:`"mystorageaccount.file.core.windows.net`" /user:`"Azure\mystorageaccount`" /pass:`"storagekey`""
    New-PSDrive -Name Z -PSProvider FileSystem -Root "\\mystorageaccount.file.core.windows.net\myfileshare" -Persist
}

Linux:

# Install cifs-utils
sudo apt-get update
sudo apt-get install cifs-utils

# Create credentials file
sudo bash -c 'echo "username=mystorageaccount" >> /etc/smbcredentials.txt'
sudo bash -c 'echo "password=storagekey" >> /etc/smbcredentials.txt'
sudo chmod 600 /etc/smbcredentials.txt

# Mount file share
sudo mkdir -p /mnt/myfileshare
sudo mount -t cifs //mystorageaccount.file.core.windows.net/myfileshare /mnt/myfileshare -o vers=3.0,credentials=/etc/smbcredentials.txt,dir_mode=0777,file_mode=0777,serverino

# Add to /etc/fstab for persistent mount
echo "//mystorageaccount.file.core.windows.net/myfileshare /mnt/myfileshare cifs vers=3.0,credentials=/etc/smbcredentials.txt,dir_mode=0777,file_mode=0777,serverino 0 0" | sudo tee -a /etc/fstab

Azure File Sync

# Install Azure File Sync agent on Windows Server
# Register server with Storage Sync Service
Import-Module "C:\Program Files\Azure\StorageSyncAgent\StorageSync.Management.PowerShell.Cmdlets.dll"
Register-AzStorageSyncServer -ResourceGroupName myResourceGroup -StorageSyncServiceName myStorageSyncService

# Create sync group
New-AzStorageSyncGroup -ResourceGroupName myResourceGroup -StorageSyncServiceName myStorageSyncService -SyncGroupName mySyncGroup

# Add cloud endpoint (Azure File Share)
New-AzStorageSyncCloudEndpoint -ResourceGroupName myResourceGroup -StorageSyncServiceName myStorageSyncService -SyncGroupName mySyncGroup -StorageAccountResourceId $storageAccountId -AzureFileShareName myfileshare

# Add server endpoint
New-AzStorageSyncServerEndpoint -ResourceGroupName myResourceGroup -StorageSyncServiceName myStorageSyncService -SyncGroupName mySyncGroup -ServerId $serverId -ServerLocalPath "D:\SyncFolder" -CloudTiering -VolumeFreeSpacePercent 20

Azure Disk Storage

Disk Types Comparison

Creating Managed Disks

# Create Premium SSD
az disk create \
  --resource-group myResourceGroup \
  --name myPremiumDisk \
  --size-gb 128 \
  --sku Premium_LRS \
  --zone 1

# Create Ultra Disk
az disk create \
  --resource-group myResourceGroup \
  --name myUltraDisk \
  --size-gb 1024 \
  --sku UltraSSD_LRS \
  --disk-iops-read-write 80000 \
  --disk-mbps-read-write 1200 \
  --zone 1

# Attach disk to VM
az vm disk attach \
  --resource-group myResourceGroup \
  --vm-name myVM \
  --name myPremiumDisk

# Detach disk
az vm disk detach \
  --resource-group myResourceGroup \
  --vm-name myVM \
  --name myPremiumDisk

Disk Encryption

# Create Key Vault for disk encryption
az keyvault create \
  --name myKeyVault \
  --resource-group myResourceGroup \
  --location eastus \
  --enabled-for-disk-encryption true

# Enable disk encryption on VM
az vm encryption enable \
  --resource-group myResourceGroup \
  --name myVM \
  --disk-encryption-keyvault myKeyVault \
  --volume-type all

# Check encryption status
az vm encryption show \
  --resource-group myResourceGroup \
  --name myVM

Disk Snapshots

# Create snapshot
az snapshot create \
  --resource-group myResourceGroup \
  --name mySnapshot \
  --source myDisk

# Create disk from snapshot
az disk create \
  --resource-group myResourceGroup \
  --name myNewDisk \
  --source mySnapshot \
  --sku Premium_LRS

Azure Data Lake Storage Gen2

Features

• Hierarchical namespace for efficient directory operations
• POSIX-compliant ACLs
• Big data analytics optimized
• Built on Azure Blob Storage (all blob features available)

Creating ADLS Gen2

# Create storage account with hierarchical namespace
az storage account create \
  --name myadlsaccount \
  --resource-group myResourceGroup \
  --location eastus \
  --sku Standard_LRS \
  --kind StorageV2 \
  --hierarchical-namespace true

# Create file system (container)
az storage fs create \
  --name myfilesystem \
  --account-name myadlsaccount \
  --auth-mode login

# Create directory
az storage fs directory create \
  --name data/2024/01 \
  --file-system myfilesystem \
  --account-name myadlsaccount \
  --auth-mode login

Access Control (POSIX ACLs)

# Set ACL on directory
az storage fs access set \
  --acl "user::rwx,group::r-x,other::---,user:oid:rwx" \
  --path data/sensitive \
  --file-system myfilesystem \
  --account-name myadlsaccount

# Set default ACL (inherited by new files)
az storage fs access set \
  --acl "default:user::rwx,default:group::r-x,default:other::---" \
  --path data \
  --file-system myfilesystem \
  --account-name myadlsaccount

Security Best Practices

Private Endpoints

# Disable public access
az storage account update \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --default-action Deny

# Create private endpoint
az network private-endpoint create \
  --name myPrivateEndpoint \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --subnet privateEndpointSubnet \
  --private-connection-resource-id $storageAccountId \
  --group-id blob \
  --connection-name myConnection

# Create private DNS zone
az network private-dns zone create \
  --resource-group myResourceGroup \
  --name "privatelink.blob.core.windows.net"

# Link DNS zone to VNet
az network private-dns link vnet create \
  --resource-group myResourceGroup \
  --zone-name "privatelink.blob.core.windows.net" \
  --name MyDNSLink \
  --virtual-network myVNet \
  --registration-enabled false

Encryption Options

1. Microsoft-managed keys (default): Automatic key rotation 2. Customer-managed keys: Use Azure Key Vault for key control 3. Customer-provided keys: Provide keys per-request (Blob only)

# Enable customer-managed key encryption
az storage account update \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --encryption-key-source Microsoft.Keyvault \
  --encryption-key-vault https://mykeyvault.vault.azure.net \
  --encryption-key-name mykey

Network Security

# Allow specific VNets
az storage account network-rule add \
  --account-name mystorageaccount \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --subnet mySubnet

# Allow specific IP addresses
az storage account network-rule add \
  --account-name mystorageaccount \
  --resource-group myResourceGroup \
  --ip-address 203.0.113.5

# Enable Azure Services bypass
az storage account update \
  --name mystorageaccount \
  --resource-group myResourceGroup \
  --bypass AzureServices Logging Metrics