DevOps Classroom notes 25/Aug/2026

Azure Terraform

1. vm
2. installtions
   1. git
   2. terraform
   3. azure-cli
3. service prinicipal
   1. access details

azure cli installtion on linux

curl -fsSL 'https://azurecliprod.blob.core.windows.net/$root/deb_install.sh' | sudo bash

sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release

sudo mkdir -p /etc/apt/keyrings
curl -sLS https://packages.microsoft.com/keys/microsoft.asc |
  gpg --dearmor | sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null
sudo chmod go+r /etc/apt/keyrings/microsoft.gpg

AZ_DIST=$(lsb_release -cs)
echo "Types: deb
URIs: https://packages.microsoft.com/repos/azure-cli/
Suites: ${AZ_DIST}
Components: main
Architectures: $(dpkg --print-architecture)
Signed-by: /etc/apt/keyrings/microsoft.gpg" | sudo tee /etc/apt/sources.list.d/azure-cli.sources

sudo apt-get update
sudo apt-get install azure-cli -y 

terraform install-cli

sudo apt-get update && sudo apt-get install -y gnupg software-properties-common

wget -O- https://apt.releases.hashicorp.com/gpg | \
gpg --dearmor | \
sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null


gpg --no-default-keyring \
--keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg \
--fingerprint


echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(grep -oP '(?<=UBUNTU_CODENAME=).*' /etc/os-release || lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update

sudo apt-get install terraform -y 

steps to create service prinicipal

1. authenticate-to-azure-with-microsoft-account

authenticate-to-azure-with-microsoft-account

• az login –tenant <tenant id>
• select subscription
• az account show

 az account show
{
  "environmentName": "AzureCloud",
  "homeTenantId": "<tenant id>",
  "id": "<sub id>",
  "isDefault": true,
  "managedByTenants": [],
  "name": "Azure subscription 1",
  "state": "Enabled",
  "tenantId": "<tenant id>",
  "user": {
    "name": "ramjagadeesh2205@outlook.com",
    "type": "user"
  }
}

• az account list –query “[?user.name==‘<microsoft_account_email>’].{Name:name, ID:id, Default:isDefault}” –output Table

 az account list --query "[?user.name=='ramjagadeesh2205@outlook.com'].{Name:name, ID:id, Default:isDefault}" --output Table

## out put 
A few accounts are skipped as they don't have 'Enabled' state. Use '--all' to display them.
Name                  ID                                    Default
--------------------  ------------------------------------  ---------
Azure subscription 1  <sub id>  True

az account set --subscription "<subscription_id_or_subscription_name>"

2. authenticate-to-azure-with-service-principle

export MSYS_NO_PATHCONV=1

“ az ad sp create-for-rbac –name <service_principal_name> –role Contributor –scopes /subscriptions/<subscription_id>

```sh
az ad sp create-for-rbac --name terraform-qt-devops --role Contributor --scopes /subscriptions/<sub id>
Creating 'Contributor' role assignment under scope '/subscriptions/<sub id>'
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
  "appId": "<appid or user id> ",
  "displayName": "terraform-qt-devops",
  "password": "<password > ",
  "tenant": "<tenant id>"
}

export ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
export ARM_TENANT_ID="<azure_subscription_tenant_id>"
export ARM_CLIENT_ID="<service_principal_appid>"
export ARM_CLIENT_SECRET="<service_principal_password>"

az login --service-principal --username <Client-ID> --password <Secret-ID> --tenant <Tenant-ID>

Try sample code

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine#example-usage-from-an-azure-platform-image

terraform init 
terraform fmt
terraform validate
terraform plan 
terraform apply