☁️ Cloud CLI (Azure, AWS, Google)

Each cloud has a command-line tool: az (Azure), aws (AWS), gcloud (Google Cloud). Sign in once, then pick the subscription, account or project to work in. Use a practice account with a budget alert.

az login && az account show --query "{name:name, id:id}" -o table
aws configure sso && aws sts get-caller-identity
gcloud auth login && gcloud config set project my-practice-project

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Resources live in regions (centralindia, ap-south-1, asia-south1). Azure groups resources in resource groups, so a whole lab can be deleted in one step.

az account list-locations --query "[?metadata.geographyGroup=='Asia Pacific'].name" -o tsv | head
az group create --name rg-gayagnan-lab --location centralindia --tags owner=student cost_centre=edu
aws ec2 describe-regions --query "Regions[].RegionName" --output text

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Buckets (S3, Blob containers, GCS) store files of any size. Keep them private by default and use lifecycle rules to move old files to cheaper tiers.

az storage account create -g rg-gayagnan-lab -n stgayagnanlab --sku Standard_LRS --allow-blob-public-access false
aws s3 mb s3://gayagnan-lab-$RANDOM --region ap-south-1
aws s3 cp notes.txt s3://gayagnan-lab-12345/
aws s3api put-public-access-block --bucket gayagnan-lab-12345 --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

A VM is a rented computer. Choose a size, an image and SSH keys; allow only the ports you need. Stop or delete VMs when finished: they cost money while running.

az vm create -g rg-gayagnan-lab -n vm-lab --image Ubuntu2404 --size Standard_B1s --admin-username student --generate-ssh-keys
az vm open-port -g rg-gayagnan-lab -n vm-lab --port 80
az vm deallocate -g rg-gayagnan-lab -n vm-lab     # stop paying for compute
aws ec2 run-instances --image-id ami-xxxxxxxx --instance-type t3.micro --key-name lab-key --count 1

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

A VNet/VPC is your private network; subnets divide it; network security groups (NSG) or security groups decide which traffic may enter.

az network vnet create -g rg-gayagnan-lab -n vnet-lab --address-prefix 10.10.0.0/16 --subnet-name web --subnet-prefix 10.10.1.0/24
az network nsg rule create -g rg-gayagnan-lab --nsg-name nsg-web -n allow-https --priority 100 --destination-port-ranges 443 --access Allow --protocol Tcp
aws ec2 create-security-group --group-name web-sg --description "HTTPS only" --vpc-id vpc-xxxx
aws ec2 authorize-security-group-ingress --group-id sg-xxxx --protocol tcp --port 443 --cidr 0.0.0.0/0

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Give people and apps only the permissions they need. Azure uses role assignments (RBAC); AWS uses IAM policies attached to roles.

az role assignment create --assignee student@school.edu --role "Reader" --scope /subscriptions/<id>/resourceGroups/rg-gayagnan-lab
aws iam create-role --role-name ReportsReader --assume-role-policy-document file://trust.json
aws iam attach-role-policy --role-name ReportsReader --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

--query (JMESPath) filters CLI output. Resource Graph and Cost Explorer answer “what do I have and what does it cost?”.

az resource list -g rg-gayagnan-lab --query "[].{name:name, type:type}" -o table
az graph query -q "Resources | summarize count() by type | top 5 by count_"
aws ce get-cost-and-usage --time-period Start=2026-10-01,End=2026-11-01 --granularity MONTHLY --metrics UnblendedCost

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

A budget emails you when spending passes a threshold. Set one before every lab: it is the cheapest insurance in cloud learning.

az consumption budget create --budget-name lab-budget --amount 500 --time-grain Monthly --start-date 2026-11-01 --end-date 2027-03-31 --category cost
aws budgets create-budget --account-id 123456789012 --budget file://budget.json --notifications-with-subscribers file://notify.json

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Container registries (ACR, ECR, Artifact Registry) store images; managed services (Container Apps, ECS/Fargate, Cloud Run) run them without managing servers.

az acr create -g rg-gayagnan-lab -n acrgayagnan --sku Basic
az acr build -r acrgayagnan -t portal:1.0 .
az containerapp up -g rg-gayagnan-lab -n portal --image acrgayagnan.azurecr.io/portal:1.0 --ingress external --target-port 8080
gcloud run deploy portal --image asia-south1-docker.pkg.dev/my-proj/web/portal:1.0 --region asia-south1 --allow-unauthenticated

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Managed Kubernetes (AKS, EKS, GKE) runs containers at scale. kubectl applies desired state from YAML and shows what is running.

az aks get-credentials -g rg-gayagnan-lab -n aks-lab
kubectl create deployment web --image=nginx:1.27 --replicas=3
kubectl expose deployment web --port=80 --type=LoadBalancer
kubectl get pods -o wide
kubectl rollout status deployment/web

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Terraform, Bicep and CloudFormation describe infrastructure in files; plan or what-if shows changes before they happen.

terraform init && terraform plan -out tfplan && terraform apply tfplan
az deployment group what-if -g rg-gayagnan-lab -f main.bicep
aws cloudformation deploy --template-file stack.yaml --stack-name lab --capabilities CAPABILITY_NAMED_IAM

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Azure Monitor uses KQL; CloudWatch Logs Insights has its own query language. Both find errors and slow requests fast.

az monitor log-analytics query -w <workspace-id> --analytics-query "AppRequests | where Success == false | summarize count() by bin(TimeGenerated, 5m)" -o table
aws logs start-query --log-group-name /aws/lambda/orders --start-time $(date -d '-1 hour' +%s) --end-time $(date +%s) --query-string 'fields @timestamp, @message | filter @message like /ERROR/ | limit 20'

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.

Deleting the resource group or stack removes everything in it. Always check the bill the next day.

az group delete -n rg-gayagnan-lab --yes --no-wait
aws cloudformation delete-stack --stack-name lab
aws s3 rb s3://gayagnan-lab-12345 --force
gcloud projects delete my-practice-project

🖥️ Run this on your own practice cloud account with a budget alert. The output depends on your machine, so no sample output is shown.