AZURE SUBSCRIPTION / LINUX VM / MONITORING

VIEW SOURCE ↗

01 · LAB OVERVIEW

Operate cloud systems
with evidence.

A reproducible reference environment for practicing Azure identity, Linux administration, network troubleshooting, monitoring, automation, and safe recovery workflows.

Scope boundary

The repository contains tested local tooling, reviewable Terraform, and documented exercises. It does not claim that cloud resources are currently deployed.

ENVIRONMENT

Azure + Linux

One resource group, VNet, protected subnet, NSG, Linux VM reference, and centralized monitoring layer.

OPERATING MODEL

Observe → change → verify

Capture the baseline, make the smallest safe change, validate recovery, and preserve evidence.

AUTOMATION

Terraform + Bash

Repeatable infrastructure definitions and bounded diagnostic commands with redacted outputs.

02 · ARCHITECTURE

Lab topology.

The resource boundary is explicit: internet traffic reaches only the NSG-approved path, administration uses controlled identity, and logs flow to a monitoring workspace.

AZURE RESOURCE GROUP
IDENTITY PLANEEntra ID

RBAC · MFA · service principal

→
NETWORK PLANEVNet / Subnet

10.42.0.0/16 · NSG rules

→
COMPUTE PLANELinux VM

SSH · patching · systemd

↓ DIAGNOSTIC SETTINGS
OBSERVABILITYLog Analytics + Azure Monitor

Metrics · queries · alerts · evidence

Control pathTelemetry pathValidated boundary

03 · RUNBOOKS

Numbered playbooks.

Each playbook follows the same operational contract: pre-checks, least-risk action, recovery validation, and rollback or escalation.

RB-01
IDENTITY / 12 MINRotate a service principal credential
+
  1. Confirm the application owner, use, and approved change window.
  2. Create the replacement credential without deleting the active one.
  3. Update the consuming secret store and restart only the dependent workload.
  4. Verify authentication telemetry before revoking the old credential.
az ad app credential reset \
  --id "$APP_CLIENT_ID" \
  --append \
  --display-name "rotation-$(date +%Y%m%d)"
RB-02
LINUX / 18 MINHarden SSH access
+
  1. Keep one verified administrative session open.
  2. Validate key-based access for the replacement account.
  3. Disable password and root login, then test configuration syntax.
  4. Reload SSH and verify a fresh connection before closing the old session.
sudo sshd -t
sudo systemctl reload ssh
sudo journalctl -u ssh --since "10 minutes ago"
RB-03
ACCESS / 20 MINStage Conditional Access
+
  1. Confirm two monitored emergency-access accounts.
  2. Target a pilot group and configure report-only mode.
  3. Review sign-in impact and resolve unexpected blocks.
  4. Approve phased enforcement with named rollback ownership.
# Review sign-in failures before enforcement
SigninLogs
| where ResultType != 0
| summarize failures=count() by UserPrincipalName
RB-04
PATCHING / 25 MINPatch and validate a Linux host
+
  1. Record disk, memory, service, and package baseline.
  2. Take the approved recovery point and confirm rollback access.
  3. Apply security updates, reboot only when required.
  4. Validate service health, logs, connectivity, and monitoring.
sudo apt-get update
apt list --upgradable
sudo unattended-upgrade --dry-run --debug

04 · TROUBLESHOOTING LOG

Symptoms become evidence.

ISSUEROOT CAUSEFIX + VERIFICATIONSTATUS
SSH timeout after NSG updateRule priority shadowed the intended allow rule.Corrected priority; verified fresh connection and Network Watcher flow.RESOLVED
Application could not resolve APIPrivate DNS zone was not linked to the workload VNet.Linked VNet; compared resolver answers and confirmed application health.RESOLVED
Service principal received 403Role assigned at the wrong resource scope.Re-scoped least-privilege role; verified successful request and audit event.RESOLVED
Alert produced no notificationAction group receiver was disabled.Enabled receiver; ran approved test alert and confirmed delivery.RESOLVED

05 · SKILLS MAP

Exercise to competency.

IAM

Identity and access

Service principals, credential rotation, MFA, Conditional Access, RBAC scope.

RB-01 · RB-03
NET

Networking

VNets, subnets, NSGs, DNS, TCP checks, routes, private service paths.

ARCH · DIAGNOSTICS
SYS

Linux operations

SSH hardening, systemd, patching, logs, recovery validation.

RB-02 · RB-04
OBS

Monitoring

Diagnostic settings, Log Analytics, Azure Monitor, alerts, evidence capture.

TROUBLESHOOTING LOG
AUT

Automation

Terraform definitions, Bash diagnostics, GitHub Actions checks, repeatability.

INFRA/ · SCRIPTS/