Cloud Resources¶

Automating cloud infrastructure with PowerShell requires more than simply calling APIs. At the expert level, you must understand how each cloud provider exposes its resources, how authentication works, how modules are structured, and how to design automation that is idempotent, scalable, and compliant with enterprise governance. This section teaches you how to work with Azure and AWS using their official PowerShell modules, with a focus on real‑world automation patterns rather than isolated commands.

1. Azure automation with Az PowerShell¶

Azure provides a comprehensive, first‑party PowerShell module called Az, which exposes nearly every Azure service through a consistent command structure. The module is cross‑platform and built on top of Azure Resource Manager (ARM), meaning all operations are API‑driven and fully automatable.

1.1 Installing the Az module¶

Install-Module Az -Scope CurrentUser

The module is large and composed of many submodules (Az.Compute, Az.Network, Az.Resources, etc.), but installing Az automatically brings them all in.

1.2 Authentication models¶

Azure supports multiple authentication flows:

Connect-AzAccount

Service principal (automation)¶

Connect-AzAccount -ServicePrincipal `
    -Tenant $tenantId `
    -ApplicationId $appId `
    -CertificateThumbprint $thumbprint

Service principals are the backbone of enterprise automation because they support RBAC, auditing, and least‑privilege access.

Managed identity (best practice in Azure)¶

Connect-AzAccount -Identity

This is the preferred method for VMs, Functions, Automation Accounts, and containers because it eliminates secrets entirely.

1.3 Creating and managing Azure resources¶

Azure resources follow a consistent pattern:

Resource group → Resource → Configuration

Create a resource group¶

New-AzResourceGroup -Name "ProdRG" -Location "JapanEast"

Deploy a virtual machine¶

New-AzVM `
    -ResourceGroupName "ProdRG" `
    -Name "Web01" `
    -Location "JapanEast" `
    -Image "Win2022Datacenter"

Create a storage account¶

New-AzStorageAccount `
    -ResourceGroupName "ProdRG" `
    -Name "prodstoragejpe01" `
    -Location "JapanEast" `
    -SkuName Standard_LRS

Azure cmdlets are declarative: you describe the desired state, and Azure ensures the resource is created or updated accordingly.

1.4 Idempotent automation with ARM/Bicep + PowerShell¶

PowerShell alone can create resources, but enterprise automation typically combines:

Bicep/ARM templates for declarative infrastructure
PowerShell for orchestration, validation, and post‑deployment configuration

Example: deploying a Bicep template from PowerShell:

New-AzResourceGroupDeployment `
    -ResourceGroupName "ProdRG" `
    -TemplateFile ".\main.bicep"

This ensures predictable, repeatable deployments across environments.

2. AWS automation with AWS Tools for PowerShell¶

AWS provides a full PowerShell module called AWS.Tools, which exposes AWS services through cmdlets that map directly to AWS APIs.

2.1 Installing AWS Tools¶

Install-Module AWS.Tools.Installer
Install-AWSToolsModule AWS.Tools.EC2,AWS.Tools.S3,AWS.Tools.IdentityManagement

AWS uses a modular approach: each service is its own module, which keeps installations lightweight.

2.2 Authentication models¶

AWS supports several authentication methods:

Credential profile (local development)¶

Set-AWSCredential -ProfileName "default"

Profiles are stored in ~/.aws/credentials.

Access keys (automation)¶

Set-AWSCredential -AccessKey $key -SecretKey $secret -StoreAs "ProdAutomation"

IAM roles (best practice)¶

When running on EC2, Lambda, ECS, or other AWS compute services, IAM roles provide temporary credentials automatically.

No secrets are stored or transmitted.

2.3 Creating and managing AWS resources¶

AWS cmdlets follow a direct mapping to AWS API operations.

Create an S3 bucket¶

New-S3Bucket -BucketName "prod-bucket-jp-01"

Upload a file¶

Write-S3Object -BucketName "prod-bucket-jp-01" -File "report.csv"

Launch an EC2 instance¶

New-EC2Instance `
    -ImageId "ami-1234567890abcdef0" `
    -InstanceType "t3.micro" `
    -MinCount 1 -MaxCount 1

AWS cmdlets are imperative: you explicitly call the API operation you want.

3. Designing cloud automation workflows¶

Expert‑level automation requires more than calling cmdlets. You must design workflows that are:

Idempotent — running the script twice should not break anything
Environment‑aware — dev, test, prod must be isolated
Credential‑safe — no secrets in scripts or logs
Auditable — all changes traceable
Modular — reusable functions and modules
Policy‑compliant — aligned with RBAC, IAM, and governance rules

Typical enterprise pattern:

Authenticate using managed identity or service principal/role
Validate environment and resource state
Deploy infrastructure declaratively (Bicep/CloudFormation)
Apply configuration using PowerShell
Store outputs and metadata in a central system
Log and audit all operations

This ensures predictable, secure, and repeatable automation.

4. Cross‑cloud automation patterns¶

Many enterprises operate in hybrid or multi‑cloud environments. PowerShell is uniquely positioned to automate across providers because:

It is cross‑platform
It supports both Azure and AWS natively
It integrates with CI/CD pipelines
It can orchestrate external tools (Terraform, CLI tools, REST APIs)

A common pattern is:

Use Terraform/Bicep/CloudFormation for infrastructure
Use PowerShell for orchestration, configuration, and validation
Use SecretManagement for credentials
Use logging modules for audit trails

This creates a unified automation layer regardless of cloud provider.

5. Summary¶

Automating cloud resources with PowerShell requires mastery of both Azure and AWS modules, along with a deep understanding of authentication, resource models, and enterprise governance. Key principles include:

Using Az for Azure and AWS.Tools for AWS
Authenticating with managed identities or IAM roles whenever possible
Creating resources through consistent, API‑driven cmdlets
Combining declarative templates with PowerShell orchestration
Designing automation that is idempotent, secure, and auditable
Applying the same PowerShell patterns across multiple cloud providers

With these skills, PowerShell becomes a powerful, cloud‑agnostic automation engine capable of managing infrastructure at enterprise scale.