Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation.
Reusable infrastructure patterns for Azure Bicep templates. Complements
iac-best-practices.instructions.md (style) and azure-defaults skill (naming, tags, regions).
| Pattern | When to Use | Reference |
|---|---|---|
| Hub-Spoke Networking | Multi-workload environments with shared services | hub-spoke-pattern |
| Private Endpoint Wiring | Any PaaS service requiring private connectivity | private-endpoint-pattern |
| Diagnostic Settings | Every deployed resource (mandatory) |
| common-patterns |
| Conditional Deployment | Optional resources controlled by parameters | common-patterns |
| Module Composition | Breaking main.bicep into reusable modules | common-patterns |
| Managed Identity Binding | Any service-to-service authentication | common-patterns |
| Budget & Cost Monitoring | Every deployment (mandatory) | budget-pattern |
| What-If / AVM Pitfalls | Pre-deployment validation & AVM gotchas | avm-pitfalls |
// modules/storage.bicep — every module follows this contract
@description('Storage account name')
param name string
param location string
param tags object
param logAnalyticsWorkspaceName string
output resourceId string = storageAccount.id
output resourceName string = storageAccount.name
output principalId string = storageAccount.identity.?principalId ?? ''
Accept name, location, tags, logAnalyticsWorkspaceName; output resourceId, resourceName, principalId.
categoryGroup: 'allLogs' + AllMetrics; pass workspace name not IDbool params with defaults; guard outputs with ternaryguid() for idempotent role names; principalType: 'ServicePrincipal'; scope narrowlymcr.microsoft.com/v2/bicep/{module}/tags/list) to discover authoritative published versions| File | Content |
|---|---|
| hub-spoke-pattern.md | Hub-spoke VNet orchestration with peering |
| private-endpoint-pattern.md | PE wiring + DNS zone groups + group ID table |
| common-patterns.md | Diagnostics, conditional deploy, module composition, managed identity |
| budget-pattern.md | Consumption budget, forecast alerts, anomaly detection |
| avm-pitfalls.md | What-if interpretation, AVM gotchas, learn more links |
| Topic | How to Find |
|---|---|
| AVM module catalog | microsoft_docs_search(query="Azure Verified Modules registry Bicep") |
| Resource type schema | microsoft_docs_search(query="{resource-type} Bicep template reference") |