// Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation.
Shared IaC deploy patterns for Bicep and Terraform deploy agents: deployment strategies, circuit breaker, known deploy issues. For preflight validation (auth, governance, stop rules), see azure-validate. USE FOR: Phased deployment, circuit breaker, deploy-specific known issues. DO NOT USE FOR: Preflight validation (use azure-validate), code generation (use azure-bicep-patterns or terraform-patterns).
Artifact template structures, H2 compliance rules, and documentation styling for agent outputs (Steps 1-7). USE FOR: generating any agent artifact, checking H2 structure compliance. DO NOT USE FOR: Azure resource configuration (use azure-defaults), Bicep/Terraform patterns (use bicep-patterns or terraform-patterns).
Azure infrastructure defaults: regions, tags, naming (CAF), AVM-first policy, security baseline, unique suffix patterns. USE FOR: any agent generating or planning Azure resources. DO NOT USE FOR: artifact template structures (use azure-artifacts), pricing lookups (read references/pricing-guidance.md on demand).
Execute Azure deployments for ALREADY-PREPARED applications that have existing infra/{iac}/{project}/.azure/plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires infra/{iac}/{project}/.azure/plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
ROUTING SKILL — delegates to specialized diagram skills. USE FOR: any diagram request when the caller does not know which tool to use. Routes to drawio, python-diagrams, or mermaid based on diagram type.
Prepare Azure apps for deployment (infra Bicep/Terraform, azure.yaml, Dockerfiles). Use for create/modernize or create+deploy; not cross-cloud migration (use azure-cloud-migrate). WHEN: "create app", "build web app", "create API", "create serverless HTTP API", "create frontend", "create back end", "build a service", "modernize application", "update application", "add authentication", "add caching", "host on Azure", "create and deploy", "deploy to Azure", "deploy to Azure using Terraform", "deploy to Azure App Service", "deploy to Azure App Service using Terraform", "deploy to Azure Container Apps", "deploy to Azure Container Apps using Terraform", "generate Terraform", "generate Bicep", "function app", "timer trigger", "service bus trigger", "event-driven function", "containerized Node.js app", "social media app", "static portfolio website", "todo list with frontend and API", "prepare my Azure application to use Key Vault", "managed identity".
| name | azure-bicep-patterns |
| description | Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation. |
| compatibility | Requires Azure CLI with Bicep extension |
Reusable infrastructure patterns for Azure Bicep templates. Complements
iac-bicep-best-practices.instructions.md (style) and azure-defaults skill (naming, tags, regions).
| Pattern | When to Use | Reference |
|---|---|---|
| Hub-Spoke Networking | Multi-workload environments with shared services | hub-spoke-pattern |
| Private Endpoint Wiring | Any PaaS service requiring private connectivity | private-endpoint-pattern |
| Diagnostic Settings | Every deployed resource (mandatory) | common-patterns |
| Conditional Deployment | Optional resources controlled by parameters | common-patterns |
| Module Composition | Breaking main.bicep into reusable modules | common-patterns |
| Managed Identity Binding | Any service-to-service authentication | common-patterns |
| Budget & Cost Monitoring | Every deployment (mandatory) | budget-pattern |
| What-If / AVM Pitfalls | Pre-deployment validation & AVM gotchas | avm-pitfalls |
// modules/storage.bicep — every module follows this contract
@description('Storage account name')
param name string
param location string
param tags object
param logAnalyticsWorkspaceName string
output resourceId string = storageAccount.id
output resourceName string = storageAccount.name
output principalId string = storageAccount.identity.?principalId ?? ''
Accept name, location, tags, logAnalyticsWorkspaceName; output resourceId, resourceName, principalId.
categoryGroup: 'allLogs' + AllMetrics; pass workspace name not IDbool params with defaults; guard outputs with ternaryguid() for idempotent role names; principalType: 'ServicePrincipal'; scope narrowlymcr.microsoft.com/v2/bicep/{module}/tags/list) to discover authoritative published versions| File | Content |
|---|---|
| hub-spoke-pattern.md | Hub-spoke VNet orchestration with peering |
| private-endpoint-pattern.md | PE wiring + DNS zone groups + group ID table |
| common-patterns.md | Diagnostics, conditional deploy, module composition, managed identity |
| budget-pattern.md | Consumption budget, forecast alerts, anomaly detection |
| avm-pitfalls.md | What-if interpretation, AVM gotchas, learn more links |
| Topic | How to Find |
|---|---|
| AVM module catalog | microsoft_docs_search(query="Azure Verified Modules registry Bicep") |
| Resource type schema | microsoft_docs_search(query="{resource-type} Bicep template reference") |