Why IaC Matters Architecturally

Infrastructure as Code isn't just automation — it's an architectural control plane. Without it, you have:

• Configuration drift — prod diverges from what you think it is
• No review process — changes bypass pull requests and peer review
• No blast radius control — one click can delete everything
• No repeatability — recreating an environment means tribal knowledge

ARM vs Bicep vs Terraform — Decision Framework

Bicep Deep Dive

Core Syntax

// Parameters with decorators
@description('The Azure region for deployment')
@allowed(['eastus', 'westeurope', 'southeastasia'])
param location string = resourceGroup().location

@minValue(1)
@maxValue(10)
param instanceCount int = 2

// Variables
var baseName = 'app-${uniqueString(resourceGroup().id)}'

// Resource with conditions
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '${baseName}st'
  location: location
  kind: 'StorageV2'
  sku: { name: 'Standard_ZRS' }
  properties: {
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
  }
}

// Loops
resource nsgRules 'Microsoft.Network/networkSecurityGroups/securityRules@2023-04-01' = [for (rule, i) in securityRules: {
  name: rule.name
  properties: rule.properties
}]

// Outputs
output storageId string = storageAccount.id
output storageName string = storageAccount.name

Key Language Features for Architects

• Decorators (@allowed, @minValue, @secure) — enforce guardrails at template level
• Conditions (if) — deploy resources conditionally based on environment
• Loops (for) — create multiple resources from arrays
• Existing resources (existing) — reference resources you don't own without recreating
• User-defined types — define complex parameter shapes for module interfaces

Deployment Scopes

Bicep/ARM deployments target a scope. The scope determines what you can deploy. This is a critical architecture concept — you deploy different things at different levels.

Modules, Registries & Versioning

Module Composition

// main.bicep — composes modules for a 3-tier app
module network './modules/network.bicep' = {
  name: 'network-deploy'
  params: {
    vnetAddressSpace: '10.1.0.0/16'
    location: location
  }
}

module compute './modules/compute.bicep' = {
  name: 'compute-deploy'
  params: {
    subnetId: network.outputs.appSubnetId
    vmSize: 'Standard_D4s_v5'
    instanceCount: instanceCount
  }
}

module data './modules/database.bicep' = {
  name: 'data-deploy'
  params: {
    subnetId: network.outputs.dataSubnetId
    skuName: 'GP_Gen5_4'
  }
}

Module Registry (Azure Container Registry)

// Consuming a module from a private registry
module network 'br:myregistry.azurecr.io/bicep/modules/network:v1.2.0' = {
  name: 'network-deploy'
  params: { ... }
}

// Publishing a module
// az bicep publish --file ./modules/network.bicep \
//   --target br:myregistry.azurecr.io/bicep/modules/network:v1.2.0

Template Specs & Deployment Stacks

What-If & Rollback

What-If Deployments

# Preview changes before deploying
az deployment group what-if \
  --resource-group rg-app-prod \
  --template-file main.bicep \
  --parameters @params.prod.json

What-if shows: Create, Delete, Modify, NoChange, Ignore. Use it in CI/CD as a mandatory gate before production deployments.

Rollback Strategies

• Redeploy previous version — IaC is idempotent; just redeploy the last-known-good commit
• Deployment Stacks — automatic cleanup when you roll back template changes
• Feature flags in parameters — toggle features without changing templates
• Blue-green at infra level — deploy new resource group, switch traffic, delete old

Multi-Environment Patterns

Parameter Files per Environment

├── main.bicep              # Shared template
├── modules/                # Reusable modules
├── params.dev.json         # Dev: small SKUs, single instance
├── params.staging.json     # Staging: prod-like but fewer replicas
└── params.prod.json        # Prod: full scale, HA, geo-redundancy

CI/CD Pipeline Pattern