AZ-400: Bicep templates for full Azure infrastructure (closes #163)

[zkarachiwala]

Exam objective

Define Azure infrastructure as code using Bicep and validate changes with what-if before applying them
(Design and implement build and release pipelines — 50–55%)

Closes #163.

Read first

• Bicep overview
• Bicep: App Service and SQL quickstart
• az deployment group what-if
• Bicep playground

What to build

An infra/main.bicep file that describes the full TimeTracker Azure infrastructure — App Service Plan, App Service, Azure SQL Server + Database, and App Configuration store — such that running it against the existing resource group makes no changes (idempotent).

Your task

1. Install the Bicep CLI: az bicep install && az bicep version
2. Export the existing resources to ARM JSON: az group export --name <resource-group> > infra/existing.json
3. Decompile to Bicep: az bicep decompile --file infra/existing.json — this creates infra/existing.bicep
4. Clean up the generated file: remove auto-generated noise, extract credentials to @secure() parameters, rename resources to be descriptive
5. Run az deployment group what-if --resource-group <rg> --template-file infra/main.bicep — fix any warnings until it shows "No change"
6. Add a GitHub Actions workflow step that runs what-if on every PR that modifies infra/**, posting the output as a PR comment

Explore

# Validate the Bicep file compiles without errors:
az bicep build --file infra/main.bicep

# Run the Bicep linter:
az bicep lint --file infra/main.bicep

# Convert back to ARM JSON to see what Bicep generates:
az bicep build --file infra/main.bicep --outfile /tmp/arm.json
cat /tmp/arm.json | jq '.resources[].type'

# Open the Bicep playground at aka.ms/bicepdemo and paste your Bicep — verify the ARM JSON it generates

Exam checkpoint

• What is the difference between ARM templates and Bicep?
• What does az deployment group what-if do and why is it useful in CI?
• What is a Bicep module and when would you extract one?
• How do you handle secrets (SQL passwords, connection strings) in Bicep without hardcoding them?
• What is the difference between az deployment group create (deploy) and what-if (preview)?

[zkarachiwala]

Moved to study-plans — tracked in the Certifications project.