Search
30 results for “nsg”
Search results
Terraform on Azure: Resource Groups, VNets, NSGs, and VMs
Build a secure Azure resource group, VNet, subnet, NSG, public IP, NIC, and Linux VM with production-minded Terraform and validation steps.
Scalable Azure Environment with Bicep: VMs, NSGs, Load Balancer
A hands-on IaC walkthrough using VS Code and Bicep to build a secure, highly available Azure environment.
Deploy an Azure Windows VM with Terraform: Step-by-Step Guide
Deploy a private Azure Windows Server VM with Terraform, including its VNet, subnet, NSG, secure RDP access, state, validation, and cleanup.
What is the difference between a security group and a network ACL?
A security group is stateful and attached to individual resources (like an instance or load balancer), if you allow inbound traffic on a port, the corresponding outbound response is automatically allowed, and rules are evaluated as an allow-list only. A network ACL is stateless and attached to a subnet, evaluating both inbound and outbound rules independently for every packet, including explicit deny rules. Security groups are the primary, more commonly used tool for per-resource access control; network ACLs add a coarser, subnet-wide layer, often left at their permissive default and used mainly for defense-in-depth or to explicitly block something.
The Tiny Tool That Would Have Stopped a Production Deploy Gone Wrong
Use direnv to load project-specific environment variables on entry, restore prior shell state on exit, and reduce wrong-account Terraform deploys.
What is a Service Control Policy (SCP), and what is the one thing it does not do?
An SCP is a policy attached to an AWS Organizations root, organizational unit, or member account that defines the maximum available permissions for every identity in that account, including that account's own administrators and its root user. What an SCP does not do is grant any permission by itself, it only sets a ceiling; an identity still needs an actual IAM allow (from an identity-based or resource-based policy) within that ceiling to do anything. An SCP with no matching IAM allow underneath it results in access denied, not access granted, which is the most common misunderstanding of how SCPs work. One exception worth knowing: SCPs never apply to the organization's management account itself, only to member accounts.
What is the difference between a resource group and a subscription in Azure?
A subscription is a billing and access-management boundary; it's tied to an agreement with Microsoft, has its own spending limits and quotas, and is typically the unit organizations use to separate environments (production vs. non-production) or business units. A resource group is a logical container inside a subscription that groups related resources (a VM, its disks, its network interface) that share the same lifecycle, created and deleted together. Deleting a resource group deletes everything in it, which makes resource groups the practical unit of "this is one deployable thing," while subscriptions are the practical unit of "this is one billing and governance boundary."
What is Azure Resource Manager (ARM) and why does every Azure operation go through it?
ARM is the deployment and management layer that every Azure operation, whether from the Portal, CLI, PowerShell, or an ARM/Bicep template, ultimately goes through. It provides a consistent API surface, handles authentication and authorization checks against Azure RBAC, and is what enables declarative deployment (submit a template describing desired resources, ARM figures out what to create/update). Because every path converges on ARM, access control and activity logging are consistent regardless of which tool was used to make a change.
How do management groups extend governance above the subscription level?
Management groups let an organization apply policies (via Azure Policy) and role assignments (via Azure RBAC) across multiple subscriptions at once, instead of configuring each subscription independently. They form a hierarchy above subscriptions, a root management group can contain child management groups (e.g., by department or environment type), each containing multiple subscriptions, so a single policy assignment at the right level of that hierarchy can enforce a rule (like "no public IP addresses" or "must use approved regions") across every subscription beneath it.
What is the difference between Blob Storage, File Storage, and Disk Storage in Azure?
Blob Storage is object storage for unstructured data (images, backups, logs), accessed via HTTP/HTTPS APIs, not mounted as a filesystem. File Storage provides fully managed file shares accessible via the SMB or NFS protocol, usable as a network drive that multiple VMs can mount simultaneously. Disk Storage provides block-level storage attached to a single VM, functioning as its virtual hard disk. The choice depends on access pattern: Blob for API-driven unstructured data at scale, File for shared network-drive-style access across machines, Disk for a VM's own persistent local-feeling storage.
What is the difference between locally redundant storage (LRS), zone-redundant storage (ZRS), and geo-redundant storage (GRS)?
LRS replicates data three times within a single datacenter; it protects against hardware failure but not a datacenter-level outage. ZRS replicates synchronously across three availability zones within one region, protecting against a single datacenter failure while keeping data within the region. GRS replicates asynchronously to a second, geographically distant region on top of LRS in the primary region, protecting against a regional disaster at the cost of the secondary copy lagging slightly behind (eventual, not synchronous, consistency) and being unreadable by default unless read access is explicitly enabled (RA-GRS).
Why would you use a NAT gateway instead of just putting a resource in a public subnet?
A NAT gateway lets resources in a private subnet initiate outbound connections to the internet (to pull a package, call an external API) while remaining unreachable from the internet for inbound connections; the NAT gateway only translates and forwards traffic the private resource itself initiated. Putting a resource directly in a public subnet with a public IP makes it directly reachable from the internet in both directions, which is unnecessary exposure for anything that only needs outbound access, like an application server that doesn't need to accept direct public traffic.
What is the difference between the working directory, the staging area, and a commit in Git?
The working directory is the actual files on disk, whatever state you've left them in. The staging area (the "index") is a snapshot of exactly what will go into the next commit; `git add` copies changes from the working directory into it, one file or hunk at a time, which is why you can commit only part of what you've changed. A commit is a permanent, immutable snapshot of the staging area at the moment you ran `git commit`, plus a pointer to its parent commit, which is what forms the project's history graph. Understanding that staging is a separate, explicit step - not just "what's changed" - explains why `git status` shows both staged and unstaged changes for the same file.
What is the difference between `git reset` and `git revert`, and when should you use each?
git reset moves the current branch pointer (and optionally the staging area and working directory) to a different commit, effectively rewriting history as if the reset-past commits never happened on this branch - fine for commits that only exist locally and haven't been pushed. git revert creates a brand new commit that applies the inverse of a previous commit's changes, leaving history intact and additive. Because it doesn't rewrite anything, revert is the safe choice for undoing a commit that's already been pushed and pulled by others; reset --hard on shared history causes exactly the same divergence problem as a rebase on a shared branch.
At what point in the Terraform workflow are Sentinel (or similar policy-as-code) checks evaluated, and why does that timing matter?
Policy checks evaluate against the plan, the output of `terraform plan`, before `terraform apply` actually provisions anything, which means a policy violation blocks the run from proceeding to apply at all. Evaluating against the plan rather than the already-applied state is what makes this a preventive control instead of a detective one; the non-compliant resource is stopped before it exists, not flagged for cleanup afterward once it's already live and potentially already been exploited or has already incurred cost.
Why is scanning IaC source (Terraform files) not sufficient on its own, without also checking the plan?
Static scanning can catch hardcoded insecure defaults but cannot see the complete result of runtime inputs, data sources, and module composition. A Terraform plan is the best prediction of the concrete resource changes Terraform is about to make, so plan policy sees substantially more than source scanning. It is not guaranteed to know every value before apply, however; security-sensitive unknown values need an explicit fail-closed or exception rule rather than being assumed safe.
If no NetworkPolicy exists in a namespace, what traffic is allowed between pods, and what changes the moment one NetworkPolicy is applied?
With no NetworkPolicy at all, pods are non-isolated: every pod can send and receive traffic from any other pod, with no restriction in either direction. The moment any NetworkPolicy selects a pod for a given direction (ingress or egress), that pod becomes isolated for that direction specifically, and only the traffic explicitly allowed by an applicable policy's rules gets through from then on; unrelated pods elsewhere in the cluster that no policy selects remain fully open. This is why introducing NetworkPolicy incrementally, rather than all at once, tends to break things: the first policy applied to a namespace can silently cut off traffic nobody had previously needed to declare.
Why does `ping` succeeding not guarantee an application on that host is reachable?
ping tests only ICMP echo reachability at the network layer; it confirms a host responds to the network, nothing about any specific service running on it. An application listening on a TCP port can be down, crashed, or blocked by a firewall rule that specifically targets that port while still allowing ICMP through, or conversely ICMP itself can be blocked while the actual service is reachable. Confirming an application is actually up requires testing the application layer directly, e.g. `curl` against its port or `ss -tulpn` to confirm something is listening at all.
Why does sending SIGKILL to a stuck process work when SIGTERM doesn't, and what does that cost you?
SIGTERM asks a process to terminate but can be caught by a signal handler, letting the process run its own cleanup logic (closing files, flushing buffers, releasing locks) before actually exiting, or in a broken process, being caught and never acted on at all. SIGKILL cannot be caught, blocked, or ignored under any circumstances, the kernel terminates the process directly, which is why it works on a process SIGTERM couldn't reach. The cost is that none of that cleanup logic runs, a database connection isn't closed cleanly, a temp file isn't removed, a lock isn't released, so SIGKILL is a last resort after SIGTERM has been given a real chance to work, not a default first move.
In a systemd unit, what is the practical difference between Type=simple and Type=forking, and why does that distinction matter for dependency ordering?
With Type=simple, systemd considers the unit started the moment the main process is forked off, it does not wait for the application to finish its own initialization, so anything depending on that unit might start before the service is actually ready to handle requests. Type=forking expects the traditional daemon pattern, the initial process forks and exits once it judges its own startup complete, so systemd marks the unit started as soon as that original process exits successfully, while the actual daemon keeps running as a separate, now-orphaned process. That only tracks the daemonization handoff, not genuine application readiness, a process can exit believing setup is done while it is still finishing initialization in the background, so Type=forking is a better signal than Type=simple but still not a readiness guarantee. Type=notify is the one that actually is readiness-safe: the service explicitly calls sd_notify to tell systemd exactly when it's ready, rather than systemd inferring readiness from process exit behavior at all.
Production-Ready AKS GitOps with Terraform and ArgoCD
The DevOps Project That Finally Made Kubernetes, GitOps, and Terraform Click
Linux Security and Hardening: SSH, Firewalls, Permissions
How Linux Protects Itself and How Administrators Make It Safer.
Linux Storage & Filesystems: Disks, Partitions, Mounts, and Disk Usage
How Linux Stores Data, Mounts Disks, and Survives Failures.
Azure Monitor Alerts, Action Groups, and Processing Rules
Set up Azure Monitor alerts, action groups, and alert processing rules step by step, so critical changes like a VM deletion never go unnoticed.
Azure Policy, Tags, and Resource Locks: Governance Guide
Implement Azure governance with Policy, resource tags, and locks: enforce standards, track cost and ownership, and protect resources from deletion.
Golden Images with Azure Compute Gallery: Hands-On Lab
A step-by-step Azure lab for creating, versioning, and deploying standardized VM images at scale.
Securing Azure Blob Storage: Network Rules, SAS, Immutability
A hands-on lab automating secure Azure Blob Storage using VNets, subnets, SAS tokens, and immutability.
Automating Active Directory User and Group Management with PowerShell
Step-by-step lab: creating users, OUs, security groups, and group memberships using PowerShell
Azure Networking with PowerShell: VNets, Peering, Network Watcher
A hands-on lab deploying VNets, peering them securely, provisioning Windows Server VMs, and validating connectivity with Network Watcher.
DHCP on Hyper-V: Scope Creation to Failover Configuration
Step-by-step deployment of a highly available DHCP service in a Hyper-V virtual environment