Lab 1: Deploy single resources using resource modules

We will create an Azure Key Vault including a role assignment for the Key Vault Secrets User role and a CanNotDelete resource lock. Normally these are different resources or can be put into individual modules or, as here, consumed in a single module. The main.bicep which consumes the module could look as simple as this.

Module used: bicep-registry-modules/avm/res/key-vault/vault at main · Azure/bicep-registry-modules (github.com)

targetScope = 'subscription'

// PARAMETERS
param location string = 'switzerlandnorth'
param resourceGroupName string = 'demo-resource-module'
param keyVaultName string = 'demo-kva'
param roleAssignments array = [
  {
    principalId: '<objectId of the user or service principal>'
    roleDefinitionIdOrName: 'Key Vault Secrets User'
  }
]

// RESOURCES
resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  location: location
  name: resourceGroupName
}

// MODULES
module kva 'br/public:avm/res/key-vault/vault:0.7.1' = {
  scope: rg
  name: keyVaultName
  params: {
    location: location
    name: keyVaultName
    roleAssignments: roleAssignments
    lock: {
      name: 'Set by code'
      kind: 'CanNotDelete'
    }
  }
}

You can manually deploy the main.bicep file using this Azure CLI command:

az deployment sub create --name resource-module --location switzerlandnorth --template-file main.bicep

Lab 2: Deploy multiple resources using pattern modules

This example of a pattern module deploys a secure and scalable AI baseline environment consisting of many interrelated resources. This is comparable to the landing zone principle, where you want to provide a secure and standardized baseline environment with minimal effort. Just that it is now automated, supported, and WAF aligned provided by Microsoft.

Module used: bicep-registry-modules/avm/ptn/ai-platform/baseline at main · Azure/bicep-registry-modules (github.com)

This module deploys a virtual machine with encryption at host by default. The encryption at host feature needs to be enabled on the subscription using Azure CLI or PowerShell, otherwise, the deployment will fail. While I recommend to enable encryption at host if possible, this is a great chance to override a default parameter, as you would with other parameters when using the module. Note line 23, where we simply override the parameter.

targetScope = 'subscription'

// PARAMETERS
param location string = 'switzerlandnorth'
param resourceGroupName string = 'demo-pattern-module'
param envNameShort string = 'demoptn'

// RESOURCES
resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  location: location
  name: resourceGroupName
}

// MODULES
module aiPlatformBaseline 'br/public:avm/ptn/ai-platform/baseline:0.3.0' = {
  scope: rg
  name: envNameShort
  params: {
    name: envNameShort
    virtualMachineConfiguration: {
      adminUsername: '<adminUsername>'
      adminPassword: '<adminPassword>'
      encryptionAtHost: false
    }
  }
}

Again, you can manually deploy the main.bicep file using this Azure CLI command:

az deployment sub create --name pattern-module --location switzerlandnorth --template-file main.bicep

Make sure to delete the resource group when you are finished to prevent cost.

The example code can also be found in my GitHub repository.

Key takeaways

• The modules offer a good level of automation, i.e. integration for role assignments
• You don’t have to maintain your own modules and container registry hosting the modules
• Modules are versioned which enables controlled maintenance
• Modules align with best practices and
• Modules are covered by official Microsoft support
• Modules are tested, documented, and published with good examples on how to use them

Conclusion

Azure Verified Modules are a great initiative targeting engineers and architects as well. It enables many organizations to bring their code into a more aligned and mature base, reducing development effort to maintain each module. At most, I highly recommend looking at AVM and checking whether it brings added value to your deployment processes. If you have any questions just let us know.

Resources

• Azure Verified Modules website
• Module Indexes | Azure Verified Modules
• Bicep Module on GitHub
• Example code