A hands-on IaC walkthrough using VS Code and Bicep to build a secure, highly available Azure environment.
Scalable cloud environments are not built by chance. They are designed with network isolation, availability, security, and automation in mind.
This hands-on lab demonstrates how a production-ready Azure environment can be deployed using Visual Studio Code and Bicep. Instead of relying solely on portal clicks, infrastructure is defined as code to ensure repeatability, consistency, and governance.
The walkthrough focuses on deploying virtual machines, securing them with NSGs, distributing traffic with a load balancer, and applying tagging for visibility and cost management.
🎥 Video Walkthrough
Lab Objectives
By the end of this lab, you will be able to:
-
Deploy Linux virtual machines using Bicep
-
Design a clean Azure VNet with multiple subnets
-
Secure workloads using Network Security Groups
-
Implement high availability with an Availability Set
-
Configure an Azure Load Balancer for traffic distribution
-
Apply consistent tagging for governance and cost control
Lab Architecture Overview
The environment includes:
-
One resource group
-
One virtual network
-
Two subnets (one per VM)
-
Two Linux virtual machines (Standard_B2s)
-
Network Security Groups per subnet
-
Availability Set
-
Azure Load Balancer (Layer 4)
Resource Group and Network Design
A dedicated resource group was created to logically group all networking and compute resources.
The virtual network was designed with non-overlapping address spaces, ensuring clean segmentation and future scalability.
Subnet separation allows security policies and traffic controls to be applied independently per workload.
Deploy Linux Virtual Machines with Bicep
Two Linux virtual machines were deployed using the Standard_B2s SKU.
Each VM was:
-
Placed in its own subnet
-
Associated with a dedicated NIC
-
Protected by subnet-level NSGs
Automation through Bicep ensured consistency across both deployments.
Network Security Groups (NSGs)
Security was enforced at the subnet level using Network Security Groups.
Inbound rules were configured to allow:
-
SSH (22): for administration
-
HTTP (80): for testing load-balanced traffic
This approach keeps security centralized and easy to audit.
Availability Set Configuration
An Availability Set was used to distribute both virtual machines across:
-
Fault domains
-
Update domains
This configuration reduces downtime during maintenance or unexpected infrastructure failures.
Azure Load Balancer Setup
What Is Azure Load Balancer?
Azure Load Balancer is a Layer 4 (TCP/UDP) service that distributes traffic across backend resources to improve availability and performance.
Configuration Steps
-
Public IPs were disassociated from individual VMs
-
A frontend IP configuration was created
-
Both VMs were added to the backend pool
-
A health probe was defined to monitor availability
-
Inbound NAT rules were configured for SSH access using custom ports
Traffic is now evenly distributed while still allowing secure administrative access.
Tagging Strategy
Consistent tagging was applied automatically using Bicep.
Tags included:
-
Environment
-
Owner
-
Project
-
Cost model
This improves governance, cost reporting, and long-term manageability.
Key Takeaway
Infrastructure as Code enables teams to deploy scalable, secure, and repeatable Azure environments.
By combining Bicep with sound network design and load balancing, this lab demonstrates how production-ready architectures can be built efficiently without sacrificing control.
