Azure Cloud Engineering Essentials

Layer 1 · Session 3 · Implemented · Azure account required

How Azure organizes resources

Establish exactly which identity, tenant, subscription, region, and lifecycle boundary you intend to change.

60–90 minutes. A resource group is free; contents may charge. Azure operations unvalidated here.
Azure hierarchyTenant contains management groups, subscriptions, resource groups, and resources.Entra tenantManagement groupSubscriptionResource groupResourceResource properties: region + tags
Region and tags describe resources; they are not containers.

Objectives

Course convention: rg-ace-environment-region with course, environment, and owner tags. Not an Azure requirement.

Prediction: app, data, and logs share lifecycle. Useful boundary?
Reveal
A dedicated resource group is usually appropriate for this learning environment.

Safe guided lab

Authenticate and inspect

az login
az account show --output table
az account list --query "[].{Name:name, Subscription:id, Tenant:tenantId, State:state}" -o table

Why and effect: Authenticates and reads context.

Verify: Confirm intended tenant and subscription.

Undo: az logout.

Cost: No Azure charges.

Select explicitly

$subscriptionId = Read-Host 'Subscription ID'
az account set --subscription $subscriptionId
if ((az account show --query id -o tsv) -ne $subscriptionId) { throw 'Selection failed' }

Why and effect: Selects by explicit ID and fails closed.

Verify: az account show -o table.

Undo: Select previous ID.

Cost: No Azure charges.

Create safely

$resourceGroup='rg-ace-learning-eastus'; $location='eastus'; $owner=Read-Host 'Owner alias'
.\scripts\deploy\New-CourseResourceGroup.ps1 -SubscriptionId $subscriptionId -ResourceGroupName $resourceGroup -Location $location -Owner $owner

Why and effect: Rechecks scope, refuses an existing target, and tags it.

Verify: Run verification.

Undo: Use guarded cleanup.

Cost: Group free; contents may charge.

Verify

.\scripts\verify\Test-CourseResourceGroup.ps1 -SubscriptionId $subscriptionId -ResourceGroupName $resourceGroup

Why and effect: Reads and validates course tag.

Verify: Exit 0.

Undo: Nothing.

Cost: No Azure charges.

Guarded cleanup

.\scripts\cleanup\Remove-CourseResourceGroup.ps1 -SubscriptionId $subscriptionId -ResourceGroupName $resourceGroup

Why and effect: Confirms subscription, course tag, and exact name before deleting all contents.

Verify: az group exists returns false.

Undo: Not generally reversible.

Cost: Stops future charges; billing may lag.

Optional portal verification

Compare directory, subscription, location, and tags; do not create a duplicate.

Troubleshooting

Wrong tenant
Log out; use az login --tenant only with an administrator-provided ID, then recheck.
Group exists
Do not reuse or delete blindly. Choose a new name or inspect ownership.

Knowledge check



Architecture delta

Added explicit subscription context and a tagged lifecycle boundary. New risk: wrong-scope mutation or deletion.

Sources

? Session 2Session 4 ?