Design and implement infrastructure as code (IaC)

infrastructure/
├── environments/
│   ├── dev/       main.bicep  dev.bicepparam
│   ├── staging/   main.bicep  staging.bicepparam
│   └── prod/      main.bicep  prod.bicepparam
├── modules/
│   ├── network/vnet.bicep
│   ├── compute/appservice.bicep
│   └── data/sql.bicep
└── tests/
    └── validate.ps1

@description('Environment name')
@allowed(['dev', 'staging', 'prod'])
param environment string = 'dev'

param location string = resourceGroup().location

@secure()
param sqlAdminPassword string          // never surfaced in logs/outputs

var appServicePlanName = 'asp-${environment}-${uniqueString(resourceGroup().id)}'

resource plan 'Microsoft.Web/serverfarms@2023-12-01' = {
  name: appServicePlanName
  location: location
  sku: {
    name: environment == 'prod' ? 'P1v3' : 'B1'   // ternary for env-specific sizing
    capacity: environment == 'prod' ? 3 : 1
  }
}

resource web 'Microsoft.Web/sites@2023-12-01' = {
  name: 'app-${environment}-${uniqueString(resourceGroup().id)}'
  location: location
  properties: {
    serverFarmId: plan.id               // implicit dependency — no dependsOn needed
    httpsOnly: true
  }
}

output webAppUrl string = 'https://${web.properties.defaultHostName}'

// modules/storage.bicep
param name string
param location string = resourceGroup().location
param sku string = 'Standard_LRS'
resource sa 'Microsoft.Storage/storageAccounts@2023-04-01' = {
  name: name
  location: location
  sku: { name: sku }
  kind: 'StorageV2'
}
output blobEndpoint string = sa.properties.primaryEndpoints.blob

// main.bicep — consume it (loops with @batchSize, conditions with 'if' also supported)
module storage 'modules/storage.bicep' = {
  name: 'storageDeploy'
  params: { name: 'st${uniqueString(resourceGroup().id)}', sku: 'Standard_GRS' }
}
output blobUrl string = storage.outputs.blobEndpoint

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": { "webAppName": { "type": "string" } },
  "variables": { "planName": "[concat('plan-', parameters('webAppName'))]" },
  "resources": [
    {
      "type": "Microsoft.Web/serverfarms",
      "apiVersion": "2023-12-01",
      "name": "[variables('planName')]",
      "location": "[resourceGroup().location]",
      "sku": { "name": "B1" }
    }
  ],
  "outputs": {
    "appUrl": { "type": "string",
      "value": "[concat('https://', parameters('webAppName'), '.azurewebsites.net')]" }
  }
}

# Preview the change set WITHOUT applying it
az deployment group what-if \
  --resource-group myRG \
  --template-file infrastructure/main.bicep \
  --parameters infrastructure/environments/prod/prod.bicepparam

# Deploy (incremental by default)
az deployment group create \
  --resource-group myRG \
  --template-file infrastructure/main.bicep \
  --parameters infrastructure/environments/prod/prod.bicepparam

# Convert an existing ARM JSON template to Bicep
az bicep decompile --file azuredeploy.json

- task: AzureCLI@2
  displayName: What-if preview
  inputs:
    azureSubscription: 'MyServiceConnection'
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      az deployment group what-if -g myRG \
        --template-file infrastructure/main.bicep \
        --parameters infrastructure/environments/$(env)/main.bicepparam

- task: AzureResourceManagerTemplateDeployment@3
  displayName: Deploy Bicep
  inputs:
    deploymentScope: 'Resource Group'
    azureResourceManagerConnection: 'MyServiceConnection'
    resourceGroupName: myRG
    location: uksouth
    csmFile: 'infrastructure/main.bicep'
    csmParametersFile: 'infrastructure/environments/$(env)/main.bicepparam'
    deploymentMode: 'Incremental'

Configuration WebServerConfig {
    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node 'WebServer01' {
        WindowsFeature IIS {
            Ensure = 'Present'
            Name   = 'Web-Server'
        }
        File WebContent {
            Ensure          = 'Present'
            Type            = 'Directory'
            DestinationPath = 'C:\inetpub\wwwroot\myapp'
            DependsOn       = '[WindowsFeature]IIS'
        }
        Service W3SVC {
            Name  = 'W3SVC'
            State = 'Running'
        }
    }
}
WebServerConfig -OutputPath ./mof     # compile to a MOF document

name: Web Application Environment
version: 1.0.0
summary: App Service + SQL Database + Key Vault
runner: ARM
templatePath: main.bicep
parameters:
  - id: appName
    name: Application name
    type: string
    required: true