Azure CLI (az)

The Azure CLI provides cross-platform command-line management for Azure infrastructure, featuring tight integration with Bicep templates and automated cloud provisioning.

When to Use

• Automating Azure Cloud Operations: Scripting resource deployment, role assignments, and monitoring via az.
• CI/CD Azure DevOps & GitHub Actions: Deploying infrastructure and applications using service principals or OIDC.
• JMESPath Querying of Azure Resources: Extracting specific cloud parameters using --query.
• Container Registry & AKS Cluster Management: Authenticating Docker clients and managing Kubernetes credentials.

Quick Start

# Login
az login

# Set Subscription
az account set --subscription "My Subscription"

# Create AKS Cluster
az aks create --resource-group myResourceGroup --name myAKSCluster --node-count 1 --generate-ssh-keys

Core Concepts

Resource Group Creation & Infrastructure Deployment

Deploying resources with Bicep / ARM templates:

# Set default subscription and location
az account set --subscription "Production-Subscription"
az configure --defaults location=eastus

# Create Resource Group
az group create --name rg-production-platform --location eastus

# Deploy infrastructure via Bicep template
az deployment group create \
  --resource-group rg-production-platform \
  --template-file main.bicep \
  --parameters environment=prod adminEmail=sysadmin@example.com

Querying and Filtering with JMESPath (--query)

Extracting resource properties without installing jq:

# List all running VMs with their private IPs and OS type
az vm list \
  --show-details \
  --query "[?powerState=='VM running'].{Name:name, IP:privateIps, OS:osType, Size:hardwareProfile.vmSize}" \
  --output table

# Get public IP address of an Application Gateway
APP_GATEWAY_IP=$(az network public-ip show \
  --resource-group rg-production-platform \
  --name pip-appgw \
  --query ipAddress \
  --output tsv)

AKS Credential Injection & ACR Authentication

Connecting to container services seamlessly:

# Log in to Azure Container Registry via native Docker
az acr login --name myproductionacr

# Fetch kubectl credentials for AKS cluster
az aks get-credentials \
  --resource-group rg-production-platform \
  --name aks-prod-cluster \
  --overwrite-existing

Common Patterns

JMESPath Filtering with TSV Output for Scripting

Problem: Parsing complex JSON output in bash scripts without external dependencies like jq.

Solution: Use --query with TSV output format:

# Extract the outbound IP addresses of an App Service as space-separated values
OUTBOUND_IPS=$(az webapp show \
  --resource-group rg-production \
  --name my-api-service \
  --query "outboundIpAddresses" \
  --output tsv)

echo "Allowlist IPs: $OUTBOUND_IPS"

Best Practices

Do:

• Authenticate GitHub Actions and pipelines using Workload Identity Federation (OIDC) rather than client secrets.
• Use --output tsv with --query when capturing single strings into shell variables without quotes.
• Test and validate deployments before execution with az deployment group what-if.
• Use az bicep directly through the CLI for clean, modular infrastructure-as-code.

Don't:

• Use interactive az login in automated headless scripts; use Service Principals or Managed Identities.
• Output sensitive keys in plain text; pipe outputs to secure files or masking variables.
• Run long operations synchronously without considering --no-wait and az resource wait.

Troubleshooting

| Error | Cause | Solution | | :--------------------------------------- | :------------------------------------------------------------------ | :---------------------------------------------------------------------- | | Please run 'az login' to setup account | Azure CLI session token expired or not logged in. | Run az login or use service principal az login --service-principal. | | az: error: unrecognized arguments | Passing parameters with wrong flag syntax or misplaced quotes. | Verify argument names with az <command> --help. | | Subscription '...' does not exist | Trying to operate on a subscription not accessible to current user. | List available subscriptions with az account list --output table. |

References

• Azure CLI Documentation