Original conceptual cover illustration. Open the cover at full size.
A Windows-first path from Terraform fundamentals to a private, monitored Azure reference architecture. The 31 lessons use PowerShell, Azure CLI, Terraform, Windows Server, IIS, networking, state, security, operations, and CI.
Open the illustrated learning website · Practice 900 original questions · Download Beyond Clickopz
The website brings together all 31 lessons, six illustrated learning phases, 87 SVG visuals, search, quizzes with explanations, and browser-local progress. Black/navy is the default theme, with a remembered light-mode option. Exercise and cleanup completion are self-reported; the website does not run Terraform or create Azure resources.
Six original phase scenes and 31 lesson-specific teaching diagrams illustrate subnets, packet paths, Windows infrastructure, state migration, secrets, private access, and the capstone. Explore the visual gallery.
Suggested learning order, not an Azure topology. Open the journey at full size.
Caution
Many lessons create billable Azure resources. Nothing in this repository runs
terraform apply for you. Read the plan, use an explicit subscription ID, and
destroy each lab unless its README identifies a downstream dependency.
Clone the repository and open it in PowerShell 7:
git clone https://github.com/Jamonygr/Azure-From-Zero-To-Hero.git
Set-Location Azure-From-Zero-To-Hero
code .Audit the workstation without installing or changing anything:
pwsh --version
terraform version
az version
git --version
code --version
./scripts/Test-AzureFromZeroToHeroToolchain.ps1 -Profile LearnerStart with CLZ-100. It is credential-free and does not deploy Azure resources. Use the optional CLZ-090 contributor setup first when the local toolchain is incomplete.
Before the first deployment, complete CLZ-110 and verify the active tenant, subscription, permissions, regional availability, and quota. CLZ-120 is the first lesson that creates an Azure resource.
Never select a subscription by display name in automation. Capture its ID, inspect it, and pass it explicitly to Terraform:
az login
az account list --output table
az account set --subscription '<subscription-id>'
$subscriptionId = az account show --query id --output tsv
az account show --query '{tenant:tenantId,subscription:id,user:user.name}' --output tableFor a deployable lesson, follow its README. The standard shape is:
Copy-Item terraform.tfvars.example terraform.tfvars
terraform init -lockfile=readonly
terraform fmt -check
terraform validate
terraform plan -var "subscription_id=$subscriptionId" -out tfplan
terraform show tfplan
terraform apply tfplan
terraform destroy -var "subscription_id=$subscriptionId"Do not commit terraform.tfvars, plan files, state files, or output containing
secrets.
| Path | Dependency rule |
|---|---|
| CLZ-090 → 100 → 110 → 120 | Optional contributor setup, local foundations, read-only Azure readiness, then first deployment |
| CLZ-170 → 180 → 190 → 200 | Network, security rules, first Windows VM, then IIS automation |
| CLZ-220 → 260 → 270 | Load-balancing concepts before manual and automatic VMSS scaling |
| CLZ-310 → backend migration → 320 | Keep CLZ-310 state storage alive until CLZ-320 is destroyed and state is migrated back |
| CLZ-290 → 350 → 380 | Private DNS before private Storage and SQL endpoints |
| CLZ-210 + 260 + 340 + 360 → 390 | Bastion, VMSS, Key Vault, and monitoring patterns combine in the capstone |
Most lessons are independently deployed even when their concepts build on an earlier lesson. CLZ-320 is the important exception: it reads state hosted by CLZ-310. Follow the state exercise and clean up in reverse order.
The catalog in curriculum/lessons.psd1 is the
source of truth for titles, phases, prerequisites, diagrams, cost tiers,
deployment modes, and navigation.
| ID | Lesson | Phase | Prerequisites | Cost | Run mode |
|---|---|---|---|---|---|
| CLZ-090 | CLZ-090 - Optional Windows Contributor Workstation Setup | Workstation | None | None | Local only |
| CLZ-100 | CLZ-100 - Terraform Foundations | Foundations | None | None | Local only |
| CLZ-110 | CLZ-110 - Azure CLI and Subscription Readiness | Foundations | CLZ-100 | None | Read-only Azure checks |
| CLZ-120 | CLZ-120 - First Azure Deployment and Terraform Workflow | Foundations | CLZ-110 | Low | Azure deployment |
| CLZ-130 | CLZ-130 - Provider Authentication | Foundations | CLZ-120 | Low | Azure deployment |
| CLZ-140 | CLZ-140 - Resource Groups and Tags | Foundations | CLZ-130 | Low | Azure deployment |
| CLZ-150 | CLZ-150 - Variables, Locals, and Outputs | Foundations | CLZ-140 | Low | Azure deployment |
| CLZ-160 | CLZ-160 - State and Locking Basics | Foundations | CLZ-150 | Low | Azure deployment |
| CLZ-170 | CLZ-170 - Virtual Network Foundation | Networking | CLZ-160 | Low | Azure deployment |
| CLZ-180 | CLZ-180 - Network Security Groups | Networking | CLZ-170 | Low | Azure deployment |
| CLZ-190 | CLZ-190 - Windows VM Basics | Windows compute | CLZ-180 | Moderate | Azure deployment |
| CLZ-200 | CLZ-200 - Windows VM IIS Bootstrap | Windows compute | CLZ-190 | Moderate | Azure deployment |
| CLZ-210 | CLZ-210 - Azure Bastion RDP | Windows compute | CLZ-200 | High | Azure deployment |
| CLZ-220 | CLZ-220 - Standard Load Balancer for Windows | Windows compute | CLZ-210 | High | Azure deployment |
| CLZ-230 | CLZ-230 - Load Balancer NAT Rules | Windows compute | CLZ-220 | Moderate | Azure deployment |
| CLZ-240 | CLZ-240 - Count with Windows VMs | Windows compute | CLZ-230 | High | Azure deployment |
| CLZ-250 | CLZ-250 - For Each with Windows VMs | Windows compute | CLZ-240 | High | Azure deployment |
| CLZ-260 | CLZ-260 - Windows VMSS Manual Scaling | Windows compute | CLZ-250 | High | Azure deployment |
| CLZ-270 | CLZ-270 - Windows VMSS Autoscaling | Windows compute | CLZ-260 | High | Azure deployment |
| CLZ-280 | CLZ-280 - NAT Gateway Outbound | Platform services | CLZ-270 | Moderate | Azure deployment |
| CLZ-290 | CLZ-290 - Private DNS | Platform services | CLZ-280 | Low | Azure deployment |
| CLZ-300 | CLZ-300 - Optional Public DNS | Platform services | CLZ-290 | Low | Optional Azure deployment |
| CLZ-310 | CLZ-310 - Remote State Storage | Platform services | CLZ-160 | Low | Azure deployment with migration |
| CLZ-320 | CLZ-320 - Cross-Environment State | Platform services | CLZ-310 | Low | Dependent Azure deployment |
| CLZ-330 | CLZ-330 - Traffic Manager Global Routing | Platform services | CLZ-200 | Low | Azure deployment |
| CLZ-340 | CLZ-340 - Key Vault Secrets | Platform services | CLZ-130 | Low | Azure deployment |
| CLZ-350 | CLZ-350 - Private Endpoint for Storage | Platform services | CLZ-290 | Low | Azure deployment |
| CLZ-360 | CLZ-360 - Azure Monitor and Log Analytics | Operations | CLZ-120 | Low | Azure deployment |
| CLZ-370 | CLZ-370 - GitHub Actions for Terraform | Operations | CLZ-120 | None | CI examples |
| CLZ-380 | CLZ-380 - Azure SQL Private Access | Operations | CLZ-290, CLZ-350 | Moderate | Azure deployment |
| CLZ-390 | CLZ-390 - Final Windows Reference Architecture | Operations | CLZ-210, CLZ-260, CLZ-340, CLZ-360 | High | Capstone Azure deployment |
Regenerate only the marked catalog and lesson-navigation blocks with:
./scripts/Sync-AzureFromZeroToHeroCurriculum.ps1 -Check
./scripts/Sync-AzureFromZeroToHeroCurriculum.ps1 -WriteThese checks do not run terraform plan, apply, provider registration, or
resource changes against Azure:
./scripts/Test-AzureFromZeroToHeroTerraform.ps1 -Format -Validate -Test -LockfileReadonly
./scripts/Test-AzureFromZeroToHeroDocs.ps1
./scripts/Test-AzureFromZeroToHeroQuality.ps1Cloud plans remain a deliberate local or manually triggered OIDC action. See CLZ-370 before enabling one.
Beyond Clickopz is available at no charge for personal reading. Its existing all rights reserved notice still applies: “free” does not mean public domain or open licensed. This repository does not add or change the book's legal terms.
The PDF predates some repository paths. Use the companion-book errata and crosswalk for current lesson and workflow locations.
- Migration guide for learners upgrading an existing checkout.
- Cost and lab safety before paid labs.
- Troubleshooting for common Terraform and Azure errors.
- Manual Azure smoke matrix for maintainers.
- Contributing, support, and security.
No software or book license is added or changed by this overhaul.