Lab: Infrastructure as Code with Bicep (local validation and what-if)

What you will learn in this TP

• Write a parameterised Bicep module
• Validate with bicep build, lint and rules
• Preview with what-if and deploy

Introduction #

What you will learn in this section

• Write a parameterised Bicep module
• Validate with bicep build, lint and rules
• Preview with what-if and deploy

Context. The team wants every environment described as code and checked before deployment. You write and test the template locally.

Prerequisites: Azure CLI with Bicep (az bicep install); PSRule for Azure optional; a trial subscription only for the last two steps  ·  Estimated time: 45 min

A parameterised Bicep template, validated locally and ready for pipeline deployment.

Hands-on #

Guided steps, with their solution.

1. 1. Write the template

   Why? Decorators (@allowed, @minLength) reject bad values before any deployment.

   Create main.bicep: ZRS storage in production and LRS otherwise, public access disabled, Linux App Service plan and outputs.

2. 2. Compile and analyse

   Why? The linter flags bad practices (secrets in outputs, old API versions, hard-coded locations).

   Compile to ARM JSON, run the linter and inspect the generated JSON.

3. 3. Test security rules

   Why? PSRule for Azure checks the template against the Well-Architected Framework without any subscription.

   Analyse the template with PSRule (container) and fix a warning if needed.

4. 4. Preview and deploy (trial subscription)

   Why? What-if shows exactly what will change; a second identical deployment changes nothing (idempotence).

   Create a group, run what-if, deploy, run what-if again then delete the group.

Difficulty level : ●●●○○ (3/5)