Generate Bicep Infrastructure as Code Templates

This skill is expert in creating Azure Bicep templates for Infrastructure as Code, writing clean, maintainable, production-ready templates that follow Azure best practices, security configurations, and cost/performance optimization. Its template structure principles call for clear parameter definitions with types and validation, proper variable usage for computed values, structured outputs for pipeline integration, kebab-case naming conventions, and modules for complex-template reusability. Its resource configuration principles require explicit API versions for stability, symbolic-name dependency management, conditions and loops for dynamic resources, and tagging for management and cost control. It covers parameter patterns with @allowed value lists, @minLength/@maxLength validation, and @secure() for sensitive values like admin passwords, security patterns like a Key Vault with RBAC authorization, soft-delete and purge protection enabled, and default-deny network ACLs, plus a managed identity resource for credential-free service authentication.

Use this skill when writing production Azure infrastructure templates that need real security and reusability patterns, not throwaway single-resource templates. It covers a module pattern for encapsulating a storage account with HTTPS-only traffic, TLS 1.2 minimum, and public blob access disabled; conditional resource creation using an if expression tied to a boolean parameter; resource loops iterating over an array of VM configs; custom exported types constraining SKU names to an allowed set; and the @batchSize() decorator for controlling parallelism when looping over many resources like per-subnet network security groups. It is not meant to skip validation before deployment - its testing guidance requires az bicep build validation, --what-if previews, environment-specific parameter files, and testing with minimally privileged service principals, not deploying templates straight to production untested.

// Key Vault integration
resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: '${namePrefix}-kv'
  location: location
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenant().tenantId
    enableRbacAuthorization: true
    enableSoftDelete: true
    softDeleteRetentionInDays: 90
    purgeProtectionEnabled: true
    networkAcls: {
      defaultAction: 'Deny'
      ipRules: []
      virtualNetworkRules: []
    }
  }
}

Given an infrastructure requirement, the skill produces complete Bicep templates: validated parameter blocks, secure resources like the Key Vault above, reusable modules with typed inputs and outputs, conditional and looped resource declarations, custom exported types, assert-based validation checks for naming constraints, and cost-optimization guidance (automatic dev VM shutdown, environment-appropriate SKUs, storage lifecycle management).

Cloud and platform engineers writing Azure Infrastructure as Code who need production-grade security and reusability patterns built in from the start - RBAC-based Key Vault access, network ACL defaults, and validated parameters - rather than assembling them ad hoc. It suits teams following the Azure Well-Architected Framework who want modular templates with parallel-deployment-aware resource loops, and who validate every template with az bicep build and --what-if previews before it reaches a CI/CD pipeline.