1# Bicep Patterns
2 
3Common patterns for Bicep infrastructure templates.
4 
5## File Structure
6 
7```
8infra/
9├── main.bicep              # Entry point (subscription scope)
10├── main.parameters.json    # Parameter values
11└── modules/
12    ├── resources.bicep     # Base resources
13    ├── container-app.bicep # Container App module
14    └── ...
15```
16 
17## main.bicep Template
18 
19```bicep
20targetScope = 'subscription'
21 
22@minLength(1)
23@maxLength(64)
24param environmentName string
25 
26@minLength(1)
27param location string
28 
29var tags = { environment: environmentName }
30 
31resource rg 'Microsoft.Resources/resourceGroups@2023-07-01' = {
32  name: 'rg-${environmentName}'
33  location: location
34  tags: tags
35}
36 
37module resources './modules/resources.bicep' = {
38  name: 'resources'
39  scope: rg
40  params: {
41    location: location
42    environmentName: environmentName
43    tags: tags
44  }
45}
46 
47output resourceGroupName string = rg.name
48```
49 
50## main.parameters.json
51 
52> ⚠️ **Warning:** This file uses ARM JSON syntax. Do **not** use `.bicepparam` syntax (`using`, `param`, `readEnvironmentVariable()`) in this file — `azd` will fail with a JSON parse error.
53 
54```json
55{
56  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
57  "contentVersion": "1.0.0.0",
58  "parameters": {
59    "environmentName": { "value": "${AZURE_ENV_NAME}" },
60    "location": { "value": "${AZURE_LOCATION}" }
61  }
62}
63```
64 
65Use `azd env set` to supply values at deploy time:
66 
67```bash
68azd env set AZURE_ENV_NAME myapp-1234
69azd env set AZURE_LOCATION eastus2
70```
71 
72## Naming Convention
73 
74```bicep
75var resourceToken = uniqueString(subscription().id, resourceGroup().id, location)
76 
77// Pattern: {prefix}{name}{token}
78// Total ≤32 chars, alphanumeric only
79var kvName = 'kv${environmentName}${resourceToken}'
80var storName = 'stor${resourceToken}'
81 
82// Container Registry: alphanumeric only (5-50 chars)
83var acrName = replace('cr${environmentName}${resourceToken}', '-', '')
84```
85 
86## Security Requirements
87 
88| Requirement | Pattern |
89|-------------|---------|
90| No hardcoded secrets | Use Key Vault references |
91| Managed Identity | `identity: { type: 'UserAssigned' }` |
92| HTTPS only | `httpsOnly: true` |
93| TLS 1.2+ | `minTlsVersion: '1.2'` |
94| No public blob access | `allowBlobPublicAccess: false` |
95 
96## Common Modules
97 
98### Log Analytics
99 
100```bicep
101resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
102  name: 'log-${resourceToken}'
103  location: location
104  properties: {
105    sku: { name: 'PerGB2018' }
106    retentionInDays: 30
107  }
108}
109```
110 
111### Application Insights
112 
113```bicep
114resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
115  name: 'appi-${resourceToken}'
116  location: location
117  kind: 'web'
118  properties: {
119    Application_Type: 'web'
120    WorkspaceResourceId: logAnalytics.id
121  }
122}
123```
124 
125### Key Vault
126 
127```bicep
128resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
129  name: 'kv-${resourceToken}'
130  location: location
131  properties: {
132    sku: { family: 'A', name: 'standard' }
133    tenantId: subscription().tenantId
134    enableRbacAuthorization: true
135  }
136}
137```
138 
139