// Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation.
Artifact template structures, H2 compliance rules, and documentation styling for agent outputs (Steps 1-7). USE FOR: generating any agent artifact, checking H2 structure compliance. DO NOT USE FOR: Azure resource configuration (use azure-defaults), Bicep/Terraform patterns (use bicep-patterns or terraform-patterns).
Prepare Azure apps for deployment (infra Bicep/Terraform, azure.yaml, Dockerfiles). Use for create/modernize or create+deploy; not cross-cloud migration (use azure-cloud-migrate). WHEN: "create app", "build web app", "create API", "create serverless HTTP API", "create frontend", "create back end", "build a service", "modernize application", "update application", "add authentication", "add caching", "host on Azure", "create and deploy", "deploy to Azure", "deploy to Azure using Terraform", "deploy to Azure App Service", "deploy to Azure App Service using Terraform", "deploy to Azure Container Apps", "deploy to Azure Container Apps using Terraform", "generate Terraform", "generate Bicep", "function app", "timer trigger", "service bus trigger", "event-driven function", "containerized Node.js app", "social media app", "static portfolio website", "todo list with frontend and API", "prepare my Azure application to use Key Vault", "managed identity".
Shared IaC deploy patterns for Bicep and Terraform deploy agents: deployment strategies, circuit breaker, known deploy issues. For preflight validation (auth, governance, stop rules), see azure-validate. USE FOR: Phased deployment, circuit breaker, deploy-specific known issues. DO NOT USE FOR: Preflight validation (use azure-validate), code generation (use azure-bicep-patterns or terraform-patterns).
Reusable Azure Terraform patterns: hub-spoke, private endpoints, diagnostics, AVM-TF modules. USE FOR: Terraform template design, hub-spoke networking, AVM modules, plan interpretation. DO NOT USE FOR: Bicep code, architecture decisions, troubleshooting, diagram generation.
| name | azure-bicep-patterns |
| description | Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation. |
| compatibility | Requires Azure CLI with Bicep extension |
Reusable infrastructure patterns for Azure Bicep templates. Complements
iac-bicep-best-practices.instructions.md (style) and azure-defaults skill (naming, tags, regions).
| Pattern | When to Use | Reference |
|---|---|---|
| Hub-Spoke Networking | Multi-workload environments with shared services | hub-spoke-pattern |
| Private Endpoint Wiring | Any PaaS service requiring private connectivity | private-endpoint-pattern |
| Diagnostic Settings | Every deployed resource (mandatory) | common-patterns |
| Conditional Deployment | Optional resources controlled by parameters | common-patterns |
| Module Composition | Breaking main.bicep into reusable modules | common-patterns |
| Managed Identity Binding | Any service-to-service authentication | common-patterns |
| Budget & Cost Monitoring | Every deployment (mandatory) | budget-pattern |
| What-If / AVM Pitfalls | Pre-deployment validation & AVM gotchas | avm-pitfalls |
// modules/storage.bicep — every module follows this contract
@description('Storage account name')
param name string
param location string
param tags object
param logAnalyticsWorkspaceName string
output resourceId string = storageAccount.id
output resourceName string = storageAccount.name
output principalId string = storageAccount.identity.?principalId ?? ''
Accept name, location, tags, logAnalyticsWorkspaceName; output resourceId, resourceName, principalId.
categoryGroup: 'allLogs' + AllMetrics; pass workspace name not IDbool params with defaults; guard outputs with ternaryguid() for idempotent role names; principalType: 'ServicePrincipal'; scope narrowlymcr.microsoft.com/v2/bicep/{module}/tags/list) to discover authoritative published versions| File | Content |
|---|---|
| hub-spoke-pattern.md | Hub-spoke VNet orchestration with peering |
| private-endpoint-pattern.md | PE wiring + DNS zone groups + group ID table |
| common-patterns.md | Diagnostics, conditional deploy, module composition, managed identity |
| budget-pattern.md | Consumption budget, forecast alerts, anomaly detection |
| avm-pitfalls.md | What-if interpretation, AVM gotchas, learn more links |
| Topic | How to Find |
|---|---|
| AVM module catalog | microsoft_docs_search(query="Azure Verified Modules registry Bicep") |
| Resource type schema | microsoft_docs_search(query="{resource-type} Bicep template reference") |