ARM & Bicep

Azure-native IaC, modules, idempotency.

Infrastructure as code (IaC) is central to DevOps: defining infrastructure declaratively in version-controlled files instead of clicking through the portal. On Azure, ARM templates and Bicep are the native IaC tools.

ARM and Bicep

Azure Resource Manager (ARM) templates are the underlying JSON format that describes Azure resources declaratively, but raw ARM JSON is verbose and hard to read. Bicep is a cleaner domain-specific language that compiles down to ARM JSON — you write concise, readable infrastructure definitions and get the same deployment. With IaC, your infrastructure lives in git: it is version-controlled, reviewed in pull requests, and reproducible, so dev, test, and production can be provisioned identically from the same code, and a change is an auditable commit rather than an untracked portal edit. Bicep is idempotent — re-deploying the same file converges to the declared state without creating duplicates — which makes it safe to run repeatedly.

// storage.bicep — readable, version-controlled, idempotent
param location string = resourceGroup().location
param name string
 
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: name
  location: location
  sku: { name: 'Standard_ZRS' }
  kind: 'StorageV2'
  properties: { allowBlobPublicAccess: false }   // secure default in code
}
// Deploy:  az deployment group create -g app-rg -f storage.bicep -p name=contosodata

Modules and reuse

As infrastructure grows, Bicep modules let you factor common patterns (a standard storage account, a hardened web app, a network) into reusable, versioned building blocks that teams consume — the same DRY principle as pipeline templates, applied to infrastructure. A platform team can publish vetted modules that encode security and compliance defaults (private networking, encryption, tagging), so every team provisions correctly by default. Parameters make modules flexible across environments. This turns infrastructure from hand-crafted snowflakes into a maintained, standardized system, and combined with deployment through a pipeline, it gives you infrastructure that is consistent, reviewable, and secure by construction across the whole estate.