Build infrastructure from code (IaC and cloud CLIs)

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Infrastructure as Code and cloud CLIs — 6

Terraform — cloud resources as code

terraform compares .tf code with the state and the real world, shows a plan, and applies it through providers (Azure, AWS, Kubernetes, GitHub).

$terraform init
$terraform fmt -recursive && terraform validate
$terraform plan -out tfplan
$terraform apply tfplan
$terraform plan -detailed-exitcode

Security checklist:

Remote state with locking (Azure Storage, S3); state holds secrets — restrict access.
Never commit *.tfstate or secret *.tfvars; commit .terraform.lock.hcl.
Scan with trivy config . or Checkov in every PR; review every plan.

5.2

Ansible — configure servers over SSH

ansible runs idempotent modules on many servers from YAML playbooks, without an agent.

$ansible all -i inventory.ini -m ping
$ansible-playbook -i inventory.ini site.yml --check --diff
$ansible-playbook -i inventory.ini site.yml -l web1 -t nginx
$ansible-vault edit group_vars/db/vault.yml

Security checklist:

Secrets in Ansible Vault or a secret manager lookup.
Use modules, not shell; run ansible-lint in CI.

5.3

Packer — golden images

packer builds a hardened VM image (Azure, AWS, QEMU) from code, so every server starts from the same patched base.

$packer init . && packer validate .
$packer build -var-file=prod.pkrvars.hcl .

Security checklist:

Deprovision at the end (SSH host keys, history, machine ID).
No secrets baked into images; rebuild monthly.

5.4

cloud-init — the first boot

cloud-init reads user-data at the first boot of a cloud VM and creates users, SSH keys, packages and files.

$cloud-init schema -c user-data.yaml --annotate
#cloud-init status --wait --long
#tail -50 /var/log/cloud-init-output.log

Security checklist:

User-data is readable inside the VM: no secrets in it.
ssh_pwauth: false, disable_root: true.

5.5

Azure CLI — manage Azure

az manages subscriptions, resource groups, VMs, networks, storage, AKS, Key Vault and RBAC — the main tool for AZ-104 and scripts.

$az login && az account set --subscription "Lab Subscription"
$az group create -n rg-lab-weu -l westeurope
$az aks get-credentials -g rg-lab-weu -n aks-lab
$az vm list -d -o table --query "[].{name:name, state:powerState}"

Security checklist:

Managed identities and OIDC instead of client secrets.
Least-privilege role assignments at the smallest scope; budgets on lab subscriptions.

5.6

AWS CLI — manage AWS

aws calls every AWS API; many DevOps jobs ask for basic S3, EC2, IAM and EKS even in Azure teams.

$aws sso login --profile lab
$aws sts get-caller-identity
$aws s3 ls
$aws eks update-kubeconfig --name eks-lab --region eu-central-1

Security checklist:

No root keys; SSO for people, OIDC roles for CI.
Block public S3 access; encryption on by default.

At work

A strong portfolio project: Terraform builds the Azure network and AKS, Packer builds the VM image, Ansible hardens it, and a GitHub Actions pipeline runs plan on the PR and apply after approval.

All commands in this chapter