Deploy resources from ARM templates and Bicep

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Automate deployments with ARM templates and Bicep

Read an ARM template

An ARM template is JSON with fixed sections. Azure reads it and creates the resources in the right order.

storage.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "name": { "type": "string" },
    "sku":  { "type": "string", "defaultValue": "Standard_LRS", "allowedValues": ["Standard_LRS", "Standard_ZRS"] }
  },
  "resources": [{
    "type": "Microsoft.Storage/storageAccounts",
    "apiVersion": "2023-05-01",
    "name": "[parameters('name')]",
    "location": "[resourceGroup().location]",
    "sku": { "name": "[parameters('sku')]" },
    "kind": "StorageV2",
    "properties": { "minimumTlsVersion": "TLS1_2", "allowBlobPublicAccess": false }
  }],
  "outputs": { "id": { "type": "string", "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]" } }
}

Section	Meaning
`parameters`	Values you give at deploy time
`variables`	Values computed inside the template
`resources`	What to create
`outputs`	Values returned after the deployment
`[ … ]`	An expression: `parameters()`, `resourceGroup()`, `concat()`, `resourceId()`

6.2

Write the same in Bicep

Bicep is shorter, has types and autocomplete (VS Code extension), and compiles to the same ARM JSON.

storage.bicep

param name string
@allowed(['Standard_LRS', 'Standard_ZRS'])
param sku string = 'Standard_LRS'
 
resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: name
  location: resourceGroup().location
  sku: { name: sku }
  kind: 'StorageV2'
  properties: { minimumTlsVersion: 'TLS1_2', allowBlobPublicAccess: false }
}
 
output id string = st.id

$az bicep install
$az bicep build --file storage.bicep
$az bicep decompile --file storage.json

6.3

Deploy a template

Deploy to a resource group (most common), a subscription, a management group or the tenant. Check first with what-if.

$az deployment group what-if -g rg-data --template-file storage.bicep --parameters name=stshop2026
$az deployment group create -g rg-data --template-file storage.bicep --parameters name=stshop2026 sku=Standard_ZRS
$az deployment group create -g rg-data --template-file storage.json --parameters @storage.parameters.json
$az deployment group list -g rg-data -o table
$az deployment group show -g rg-data -n storage --query properties.outputs

Mode	Behaviour
Incremental (default)	Adds and changes resources; others in the group stay
Complete	Deletes resources in the group that are not in the template

Watch out

--mode Complete on the wrong resource group deletes everything else in it. Use what-if first.

6.4

Export a template from existing resources

Build once in the portal, then export the template and keep it in Git.

$az group export --name rg-data > rg-data.json

In the portal: resource group → Export template, or Download a template for automation on any create page.
Exported templates often need clean-up (hard-coded names, unneeded properties).

6.5

Use parameter files

Keep one template and one parameter file per environment.

storage.parameters.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": { "name": { "value": "stshopprod" }, "sku": { "value": "Standard_ZRS" } }
}

Bicep can also use .bicepparam files: using 'storage.bicep' then param name = 'stshopprod'.

All commands in this chapter