Work with the three big clouds

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Cloud CLIs — 4

Azure CLI

az manages Azure: resource groups, VMs, AKS, Key Vault, role assignments.

$az login
$az account set --subscription "Prod"
$az aks get-credentials -g rg-shop -n aks-shop
$az vm list -d -o table

8.2

AWS CLI

aws manages AWS: EC2, S3, IAM, EKS, CloudWatch — with profiles per account.

$aws sso login --profile prod
$aws sts get-caller-identity --profile prod
$aws eks update-kubeconfig --name shop --region eu-west-1
$aws s3 cp backup.tar.gz s3://acme-backups/

8.3

gcloud

gcloud manages Google Cloud: projects, VMs, GKE, Cloud Run, IAM.

$gcloud config set project acme-shop-prod
$gcloud container clusters get-credentials shop-gke --region europe-west4
$gcloud run deploy shop --image europe-west4-docker.pkg.dev/acme/apps/shop:1.4.0 --region europe-west4

8.4

eksctl

eksctl makes EKS clusters with node groups and IAM roles for pods from one YAML file.

$eksctl create cluster -f cluster.yaml
$eksctl upgrade cluster --name shop --version 1.32 --approve
$eksctl create iamserviceaccount --cluster shop --namespace shop --name s3-reader --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess --approve

8.5

Know the same service in three clouds

One table for the names you meet in job ads.

Building block	Azure	AWS	Google Cloud
Network	VNet	VPC	VPC
VM	Virtual Machine	EC2	Compute Engine
Managed Kubernetes	AKS	EKS	GKE
Containers without servers	Container Apps	ECS / Fargate	Cloud Run
Object storage	Blob Storage	S3	Cloud Storage
Secrets	Key Vault	Secrets Manager	Secret Manager
Identity for workloads	Managed Identity	IAM roles	Service accounts
Monitoring	Azure Monitor	CloudWatch	Cloud Monitoring
IaC native	Bicep / ARM	CloudFormation	Deployment Manager

8.6

Log in from CI without stored keys

GitHub Actions and GitLab can get short-lived cloud tokens with OIDC — no secret keys in the pipeline.

Azure: a federated credential on an app registration; azure/login with client-id, tenant-id, subscription-id.
AWS: an IAM role that trusts token.actions.githubusercontent.com; aws-actions/configure-aws-credentials.
Google Cloud: Workload Identity Federation; google-github-actions/auth.

Remember

Check the active account before every delete: az account show, aws sts get-caller-identity, gcloud config list.

All commands in this chapter