Azure CLI Cheatsheet: VMs, AKS, Storage and RBAC

# install (macOS — Homebrew)
brew update && brew install azure-cli

# install (Linux — Microsoft script)
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# verify
az --version            # azure-cli 2.65+

# human login (browser)
az login                                 # interactive
az login --use-device-code               # remote shell / no browser
az login --tenant TENANT_ID              # pin a tenant

# service principal (CI)
az login --service-principal -u APP_ID -p PASSWORD --tenant TENANT_ID

# managed identity (inside Azure VM/Function)
az login --identity

# pick a subscription
az account list --output table
az account set --subscription "Prod"

# defaults — shorten future commands
az configure --defaults group=rg-prod location=eastus
az config set core.output=table
az config set core.no_color=yes        # for CI logs

# --query is JMESPath; --output controls shape.

# all VMs as a flat table with selected fields
az vm list --query "[].{Name:name, RG:resourceGroup, Size:hardwareProfile.vmSize, State:powerState}" \
  --output table

# filter by tag
az vm list --query "[?tags.env=='prod'].id" --output tsv

# nested property + projection
az resource list \
  --resource-type Microsoft.Web/sites \
  --query "[].{Name:name, RG:resourceGroup, Plan:appServicePlanId}" \
  --output table

# pipe IDs into a delete loop
az vm list --query "[?tags.env=='stale'].id" --output tsv \
  | xargs -I{} az vm delete --ids {} --yes --no-wait

# ARG (Resource Graph) — Kusto across all subs in tenant
az graph query -q "Resources | where type =~ 'microsoft.compute/virtualmachines' | summarize count() by location"

# create a service principal scoped to a resource group (CI-friendly)
SP=$(az ad sp create-for-rbac \
  --name "ci-deployer" \
  --role Contributor \
  --scopes "/subscriptions/$SUB/resourceGroups/rg-prod" \
  --json-auth)

echo "$SP" > sa.json   # appId, password, tenant, subscriptionId

# add an extra role at a narrower scope
az role assignment create \
  --assignee "$(echo "$SP" | jq -r .clientId)" \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/$SUB/resourceGroups/rg-prod/providers/Microsoft.Storage/storageAccounts/myacct"

# audit: who has what on a resource group
az role assignment list \
  --resource-group rg-prod \
  --output table

# revoke
az role assignment delete \
  --assignee APP_ID \
  --role Contributor \
  --scope "/subscriptions/$SUB/resourceGroups/rg-prod"

# create an AKS cluster (small, managed identity, single node pool)
az aks create \
  --resource-group rg-prod \
  --name aks-prod \
  --node-count 2 \
  --enable-managed-identity \
  --generate-ssh-keys \
  --enable-cluster-autoscaler --min-count 1 --max-count 5

# wire kubectl to it (--admin uses the local-admin kubeconfig)
az aks get-credentials -g rg-prod -n aks-prod --overwrite-existing
kubectl get nodes

# scale node pool
az aks nodepool scale -g rg-prod --cluster-name aks-prod --name nodepool1 --node-count 4

# upgrade control plane + nodes
az aks get-upgrades -g rg-prod -n aks-prod --output table
az aks upgrade -g rg-prod -n aks-prod --kubernetes-version 1.30.0 --yes

# end-to-end: ship a containerized web app to App Service with Key Vault secret
RG=rg-prod
LOC=eastus
ACR=myregistry$RANDOM
APP=hello-app
PLAN=plan-linux
KV=kv-prod-$RANDOM

# 1) create RG, registry, App Service plan
az group create -n $RG -l $LOC
az acr create -g $RG -n $ACR --sku Basic --admin-enabled false
az appservice plan create -g $RG -n $PLAN --is-linux --sku B1

# 2) build + push the image inside ACR (no local Docker needed)
az acr build -r $ACR -t app:v1 .

# 3) put the API key in Key Vault, let the app read it
az keyvault create -g $RG -n $KV --enable-rbac-authorization true
az keyvault secret set --vault-name $KV --name api-key --value "s3cr3t"

# 4) create the web app, attach managed identity, grant KV access
az webapp create -g $RG -p $PLAN -n $APP --deployment-container-image-name $ACR.azurecr.io/app:v1
az webapp identity assign -g $RG -n $APP
PRINCIPAL=$(az webapp identity show -g $RG -n $APP --query principalId -o tsv)
az role assignment create --assignee "$PRINCIPAL" \
  --role "Key Vault Secrets User" \
  --scope "$(az keyvault show -n $KV --query id -o tsv)"

# 5) wire the secret as an env var (KV reference)
az webapp config appsettings set -g $RG -n $APP --settings \
  API_KEY="@Microsoft.KeyVault(VaultName=$KV;SecretName=api-key)"

# 6) tail the logs
az webapp log tail -g $RG -n $APP