book

Azure Infrastructure as Code

Name: Azure Infrastructure as Code
ISBN: 9781617299421

by Henry Been, Eduard Keilholz, Erwin Staal

August 2022

Intermediate to advanced

368 pages

9h 53m

English

Manning Publications

Read now

Unlock full access

inside front cover
Azure Infrastructure as Code
Copyright
contents
front matter
forewordprefaceacknowledgmentsabout this bookWho should read this bookHow this book is organized: A roadmapAbout the codeliveBook discussion forumOther online resourcesabout the authorsabout the cover illustration
Part 1. Introduction
1 Infrastructure as Code
1.1 Working with infrastructure1.1.1 DevOps1.1.2 Preventing configuration drift1.2 The benefits of Infrastructure as Code1.2.1 IaC allows for automation1.2.2 IaC allows for a declarative approach1.2.3 IaC provides a human-readable format1.3 The Azure Resource Manager1.3.1 Control plane and data plane1.3.2 ARM templates1.3.3 The Bicep language1.3.4 Azure Service Management (ASM is not ARM)1.4 Other tools1.4.1 AWS CloudFormation1.4.2 Google Cloud Deployment Manager1.4.3 Terraform1.4.4 Pulumi1.4.5 Choosing between cloud-specific and multi-cloud solutionsSummary
2 Writing your first ARM template
2.1 Working with JSON files2.1.1 Installing the ARM templates extension in VS Code2.2 Writing ARM templates in VS Code2.2.1 Adding a resource2.2.2 Leveraging IntelliSense in VS Code2.3 Deploying an ARM template2.4 Monitoring template deployments2.5 Finding example templates2.6 Visualizing templatesSummary
Part 2. Taking it up a notch
3 Writing ARM templates
3.1 Resources3.1.1 Child resources3.2 Parameters3.2.1 Parameter types3.2.2 Limiting and describing parameter values3.2.3 Specifying parameter values3.3 Variables3.4 Outputs3.5 Functions3.5.1 Expressions3.5.2 Built-in functions3.5.3 User-defined functionsSummary

4 Deploying ARM templates
4.1 An overview of the deployment process4.2 Submitting a deployment4.2.1 Choosing a deployment scope4.2.2 Submitting a template using different tools4.3 The execution phase4.3.1 Role-based access control4.3.2 Azure Policy4.3.3 Resource locks4.3.4 Resource provisioning4.4 The clean-up phase4.4.1 Incremental deployment mode4.4.2 Complete deployment mode4.4.3 Combining deployment modes4.5 Template validation and what-if deployments4.5.1 Validating an ARM template4.5.2 What-if deployments4.6 Troubleshooting template deploymentsSummary
5 Writing advanced ARM templates
5.1 Deploying to multiple scopes using nested templates5.1.1 Nested templates on a management group5.1.2 Evaluation scope5.1.3 Outputs5.2 How to structure solutions5.2.1 Small to medium solutions5.2.2 Large solutions5.3 Modularizing templates with linked templates5.3.1 Using a URI5.3.2 Using a relative path5.4 Deploying resources in order5.4.1 Explicit deployment ordering5.4.2 Implicit deployment ordering5.5 Conditionally deploying resources5.5.1 Applying conditions to output5.6 Using loops to create multiple resources5.6.1 Using copy on variables5.6.2 Using copy on properties5.6.3 Using copy on output5.6.4 Waiting for a loop to finish, using dependsOn5.7 Deployment scripts5.8 Reverse engineering a template5.8.1 Exporting templates5.8.2 Using Resource Explorer5.8.3 Using the JSON view5.8.4 For a new resourceSummary
6 Simplifying ARM templates using the Bicep DSL
6.1 Bicep: A transpiler6.1.1 Deploying6.1.2 Transpiling6.1.3 Decompiling6.2 Bicep syntax differences6.2.1 Parameters6.2.2 Variables6.2.3 Outputs6.2.4 Conditions6.2.5 Loops6.2.6 Targeting different scopes6.2.7 Known limitations6.3 Other improvements with Bicep6.3.1 Referencing resources, parameters, and variables6.3.2 Using references in variables and outputs6.3.3 Referencing existing resources6.3.4 Dependency management6.3.5 String interpolation6.3.6 No mandatory grouping6.3.7 Comments6.3.8 Using the contents of other files6.4 Modules6.4.1 Deploying to another scope6.4.2 Debugging Bicep deployments6.5 A larger Bicep example6.5.1 AppConfiguration.bicep6.5.2 ApplicationInsights.bicep6.5.3 Configuration.bicepSummary
7 Complex deployments using Azure DevOps
7.1 Meet Toma Toe Pizzas7.2 Crafting the Bicep files7.2.1 Describing the App Service plan7.2.2 Describing the App Service7.2.3 Finalizing the template7.3 Storing templates in source control7.4 Automated build and release pipelines7.4.1 Using triggers7.4.2 Creating tasks7.4.3 Grouping tasks in a job7.4.4 Creating service connections7.4.5 Configuring Azure DevOps to run your pipeline7.5 Adding logical phases to your pipeline7.5.1 Identifying the logical phases7.5.2 Accessing artifacts from different jobs7.5.3 Transpiling Bicep in a pipeline stage7.5.4 Deploying a template from a pipeline artifact7.6 Adding the Traffic Manager7.6.1 Deploying the Traffic Manager7.7 Creating a real-world example pipeline7.7.1 Completing the pipelineSummary
8 Complex deployments using GitHub Actions
8.1 Forking a repository8.2 Getting to know GitHub Actions8.2.1 Workflow events8.2.2 Runners8.2.3 Jobs8.2.4 Steps8.2.5 Actions8.3 Building a GitHub Actions workflow8.3.1 Adding a job to a GitHub Actions workflow8.4 The deployment phase in GitHub Actions8.4.1 Connecting to Azure from your GitHub workflow8.4.2 Generating a service principal using the Azure CLI8.5 Deploying ARM templates from GitHub Actions8.5.1 Completing the deploymentSummary
9 Testing ARM templates
9.1 Static analysis and validation9.1.1 Visual Studio Code extensions9.1.2 Validation using PowerShell or Azure CLI9.1.3 ARM template test toolkit9.1.4 Custom tests using Pester9.2 Unit tests9.3 Integration tests9.4 End-to-end tests9.5 Pester in CI/CDSummary
Part 3. Advanced topics
10 Template specs and Bicep registries: Building a repository of templates
10.1 Use case: A repository of compliant resources10.2 Creating a template spec10.2.1 Listing template specs10.2.2 Template spec versions10.2.3 Creating a template spec from multiple ARM templates10.2.4 Deploying a template spec using IaC is impractical10.3 Deploying a template spec10.3.1 Deploying template specs from an ARM or Bicep template10.3.2 Upgrading to a newer version of the template spec10.4 An alternative: A Bicep registry10.5 Sharing templates using a package manager10.5.1 Publishing an ARM template as a package10.5.2 Deploying an ARM template that is in a package10.5.3 Yet another approach10.6 Design considerations10.6.1 Choosing an approach10.6.2 Pros and cons of template specs10.6.3 Pros and cons of using a Bicep registry10.6.4 Pros and cons of using a package managerSummary
11 Using deployment stacks for grouping resources
11.1 Grouping resources by their lifetime11.1.1 Complete deployment mode is not good enough11.1.2 Deployment stacks to the rescue!11.1.3 Creating a deployment stack11.1.4 Updating a deployment stack11.1.5 Removing a deployment stack11.2 Provisioning resources for others, but disallowing updates11.2.1 Azure Blueprints: A first solution11.3 The future of deployment stacksSummary
12 Governing your subscriptions using Azure Policy
12.1 Azure Policy12.1.1 Policy definitions12.1.2 Initiatives or policy sets12.1.3 Assignment12.2 Examining the built-in policies and initiatives12.3 Using custom policies12.3.1 Creating a custom policy12.3.2 Testing a policy12.4 Using the different effects12.4.1 Append effect12.4.2 Audit effect12.4.3 AuditIfNotExists effect12.4.4 DeployIfNotExists effect12.4.5 Disabled effect12.4.6 Modify effect12.5 Creating your own initiative12.6 Assigning a policy or initiative12.7 Reviewing compliance status12.7.1 Remediating noncompliant resources12.7.2 Creating an exemptionSummary
13 Case studies
13.1 Building an Azure foundation13.1.1 The management group layout13.1.2 Assigning a policy initiative13.1.3 Creating a management subscription13.1.4 Creating workload subscriptions13.2 Subscription level deployments13.2.1 Configuring budgets13.2.2 Configuring Microsoft Defender for Cloud13.2.3 Creating resource groups and providing access13.3 Creating a highly-available microservice architecture13.3.1 Resources organized in resource groups13.3.2 Networking with Bicep13.3.3 Using the existing keyword to set access to a Key VaultSummary
index
inside back cover

Content preview from Azure Infrastructure as Code

index

AAD (Azure Active Directory) 327

role-based access control 78

tenant 69

actions, in GitHub 191

aliases 295

@allowed() decorator 158

allowedValues property 45, 289

Amazon Web Service (AWS) CloudFormation 14

and() function 63

apiVersion property 22, 37, 131

Append effect 80, 279, 294 – 295, 301 – 302

APPINSIGHTS_INSTRUMENTATIONKEY setting 62

approvals 169

ARM (Azure Resource Manager) 11 – 14

Bicep language 13

control plane and data plane 11 – 12

template deployment 66 – 88

clean-up phase 82 – 85

execution phase 75 – 82

overview of process 67 – 68

submitting 68 – 74

troubleshooting deployments 87

validation phase 85 – 86

with Azure DevOps 155 – 187

with GitHub Actions 188 – 200

templates, basics of 12 – 13

template sharing

deploying templates ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781617299421Publisher Support Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Azure Infrastructure as Code

by Henry Been, Eduard Keilholz, Erwin Staal

index

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.