Skip to content

Azure From Zero To Hero

Overview

Jamonygr/Azure-From-Zero-To-Hero

Platform services¶

Platform services illustrated Azure and Terraform learning scene — Original conceptual phase artwork; individual lessons define the actual deployed services. Open at full size.

CLZ-280 — NAT Gateway and a Standard static public IP are associated only with web-snet. A dashed future-workload egress path is illustrative: this lesson deploys no VM and NAT provides neither inbound access nor firewall filtering. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-280

NAT Gateway Outbound

Platform services

Moderate relative cost

Azure deployment

30 questions

Prerequisites: CLZ-270

Open lesson →

CLZ-290 — A VNet link connects private clz.internal resolution to a manually configured web A record for 10.40.1.10. Registration is disabled and the address does not represent a host deployed by this lesson. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-290

Private DNS

Platform services

Low relative cost

Azure deployment

30 questions

Prerequisites: CLZ-280

Open lesson →

CLZ-300 — The default path creates a resource group without a public DNS zone. A dashed opt-in branch creates an owned zone, while registrar delegation remains external. Public authority depends on delegation and check warnings do not block apply. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-300 · Optional

Optional Public DNS

Platform services

Low relative cost

Optional Azure deployment

30 questions

Prerequisites: CLZ-290

Open lesson →

CLZ-310 — Bootstrap CLZ-310 with local state, migrate it to the protected tfstate blob, and keep the backend for the separate CLZ-320 consumer. Cleanup first removes the consumer, migrates CLZ-310 back locally, then destroys the backend. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-310

Remote State Storage

Platform services

Low relative cost

Azure deployment with migration

30 questions

Prerequisites: CLZ-160

Open lesson →

CLZ-320 — CLZ-320 reads exported root outputs from an existing CLZ-310 blob using four typed backend coordinates and Microsoft Entra ID. Its own resource group and local state have a separate lifecycle; state-reading permissions can expose the producer snapshot. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-320

Cross-Environment State

Platform services

Low relative cost

Dependent Azure deployment

30 questions

Prerequisites: CLZ-310

Open lesson →

CLZ-330 — Traffic Manager returns priority-based DNS answers and probes two existing HTTPS services. The client's HTTPS connection goes directly to an endpoint. Traffic Manager does not terminate TLS; the client hostname still needs endpoint certificate coverage and correct host routing. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-330

Traffic Manager Global Routing

Platform services

Low relative cost

Azure deployment

30 questions

Prerequisites: CLZ-200

Open lesson →

CLZ-340 — Terraform generates a password, stores it in a Key Vault secret, and retains its value in state. The applying identity uses an access policy and restricted IPv4 path. Validation reads metadata, while sensitive redaction does not remove state secrets. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-340

Key Vault Secrets

Platform services

Low relative cost

Azure deployment

30 questions

Prerequisites: CLZ-130

Open lesson →

CLZ-350 — A blob Private Endpoint in data-snet connects the public-disabled Storage account to its private DNS overlay. A dashed existing-client path resolves the normal blob hostname privately and still needs correct routing, TLS, and data authorization. — Lesson teaching diagram; read the arrow legend. Open at full size.

CLZ-350

Private Endpoint for Storage

Platform services

Low relative cost

Azure deployment

30 questions

Prerequisites: CLZ-290

Open lesson →