Skip to content

Commit bf1bf6d

Browse files
riosengineerriosengineer
authored
Imports / Exports Example (#25)
* Add Azure Bicep Imports and Exports examples * Refine README.md for Public Bicep Registry section, correcting typos and enhancing clarity on Azure Verified Modules * Update MegaLinter workflow to use actions/checkout@v4 * Update MegaLinter workflow to use actions/upload-artifact@v4
1 parent a6639ac commit bf1bf6d

5 files changed

Lines changed: 205 additions & 15 deletions

File tree

‎.github/workflows/mega-linter.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
steps:
3232
# Git Checkout
3333
- name: Checkout Code
34-
uses: actions/checkout@v3
34+
uses: actions/checkout@v4
3535
with:
3636
token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
3737
fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances
@@ -54,7 +54,7 @@ jobs:
5454
# Upload MegaLinter artifacts
5555
- name: Archive production artifacts
5656
if: ${{ success() }} || ${{ failure() }}
57-
uses: actions/upload-artifact@v3
57+
uses: actions/upload-artifact@v4
5858
with:
5959
name: MegaLinter reports
6060
path: |

‎bicep-examples/consuming-modules/README.md‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,20 @@ If you're new to Bicep understanding the different ways to consume modules can b
88

99
Please review the blog post to get an understanding on the pros & cons of each consumption method. These are based on real world experiences using all methods, straight from the battlefield.
1010

11-
## Public Bicep Registry
11+
## Public Bicep Registry (Azure Verfieid Modules)
1212

1313
The public registry can be consumed directly from anywhere with ease and has quick adoption with no start up overhead as the modules are centrally stored by the team.
1414

15-
```javascript
16-
module public_registry 'br/public:compute/function-app:2.0.1' = {
17-
name: 'public_registry_example'
15+
The concept of AVM allows these modules to accelerate teams to deploy with Bicep, using best practice & aligned to the Well-Architected Framework that is managed by Microsoft so you don't have to maintain the modules yourselves. Be sure to check out more on [AVM](https://azure.github.io/Azure-Verified-Modules/overview/introduction/).
16+
17+
```bicep
18+
module KeyVault 'br/public:avm/res/key-vault/vault:0.7.0' = {
19+
name: 'avm_exmple'
1820
params: {
19-
name: 'example-func-001'
21+
name: 'kvName'
2022
location: 'uksouth'
21-
storageAccountName: 'stsomestorageaccount001'
22-
storageAccountResourceGroup: 'rg-some-rg-here'
23+
sku: 'standard'
24+
enableSoftDelete: true
2325
}
2426
}
2527
```
@@ -88,9 +90,3 @@ module inline_module 'modules/inline/customModule.bicep' = {
8890
}
8991
}
9092
```
91-
92-
## Azure Verified Modules / Azure Bicep Public Registry
93-
94-
[AVM](https://azure.github.io/Azure-Verified-Modules/faq/#what-is-happening-to-existing-initiatives-like-carml-and-tfvm)
95-
96-
This is still in development at the time of writing. However, there is a new initiative by the IaC teams at Microsoft to present what good Infrastructure-as-Code looks like. The idea here will be these modules will accelerate teams to deploy with Bicep, using best practice & aligned to the Well-Architected Framework.

‎bicep-examples/imports-exports/README.md‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# Azure Bicep - Imports and Exports
2+
3+
## Introduction
4+
5+
The import and export feature in Bicep allows you to reuse commonly used variables and types efficiently. Exports enable you to define variables that can be imported for use in other templates, while imports allow you to pull in pre-defined variables—eliminating the need to duplicate code across multiple Bicep files.
6+
7+
Instead of manually defining a variable in every new Bicep file, such as:
8+
9+
`var budgetAlertEmail = 'dan@rios.engineer'`
10+
11+
You can store this value centrally and simply import it into your template when needed.
12+
13+
This functionality extends beyond just variables (and types). It can be applied to various use cases, such as subscription IDs, service principal IDs, app registrations, and private DNS zone FQDNs and tons more. Helping maintain consistency and reducing repetitive code.
14+
15+
## 📃 Benefits of User Defined Types
16+
17+
✅ Centraliation: Allows you to define commonly repeated variables and user defined types in one file that many Bicep templates can reuse.
18+
19+
✅ Reduces repetition: Variables you may be repeating in each Bicep template can now be moved centrally, reducing repetition and streamlining templates.
20+
21+
✅ Resuability: The exports can now be used across multiple projects and templates allowing much greater resuability for standards and common values. This can also help reduce configuration errors.
22+
23+
## Export Examples
24+
25+
In the exports example, you can define what variables or types you want to be available to be imported by defining an @export() decorator next to them.
26+
27+
For example, a `shared.bicep` file could reside in the root of your Bicep folder within your repository, with these commonly used variables as an example:
28+
29+
```bicep
30+
// shared.bicep with common vars
31+
@export()
32+
@description('The Primary Azure Region location')
33+
var location = 'uksouth'
34+
35+
@export()
36+
@description('Branch Office Public IP')
37+
var branchOfficePublicIP = '82.110.72.90'
38+
```
39+
40+
### Entra example:
41+
42+
```bicep
43+
@export()
44+
@description('Common Entra Security Group(s) for RBAC')
45+
var entraSecurityGroups = {
46+
SG_Cloud_Team: {
47+
displayName: 'SG_Cloud_Team'
48+
objectId: '11111111-1111-1111-1111-111111111111'
49+
}
50+
SG_Security_Team: {
51+
displayName: 'SG_Security_Team'
52+
objectId: '22222222-2222-2222-2222-222222222222'
53+
}
54+
SG_Dev_Team: {
55+
displayName: 'SG_Dev_Team'
56+
objectId: '33333333-3333-3333-3333-333333333333'
57+
}
58+
}
59+
```
60+
## Import Examples
61+
### Entra ObjectId
62+
```bicep
63+
import * as shared from 'shared.bicep'
64+
65+
module rg 'br/public:avm/res/resources/resource-group:0.4.1' = {
66+
...
67+
roleAssignments: [
68+
{
69+
principalId: shared.entraSecurityGroups.SG_Cloud_Team.objectId // Using imported Entra Security Group Object ID
70+
roleDefinitionIdOrName: 'Contributor'
71+
}
72+
]
73+
```
74+
75+
### ACL IP Example:
76+
```bicep
77+
import * as shared from 'shared.bicep'
78+
// or you can only import the required variable vs all available via
79+
// import { branchOfficePublicIP } as branchOfficePublicIP from 'shared.bicep' as an example
80+
module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
81+
....
82+
networkAcls: {
83+
defaultAction: 'Deny'
84+
bypass: 'AzureServices'
85+
virtualNetworkRules: []
86+
ipRules: [
87+
{
88+
value: shared.branchOfficePublicIP // using central import value from shared.bicep
89+
action: 'Allow'
90+
}
91+
]
92+
}
93+
}
94+
```
95+
96+
## 🚀 Deployment
97+
98+
> [!NOTE]
99+
> You need to have a resource group deployed before trying this out.
100+
101+
In VisualStudio Code open a terminal and run:
102+
103+
CLI
104+
105+
```bash
106+
az login
107+
az account set --subscription 'subscription name or id'
108+
az deployment group create -g 'your-rg' --confirm-with-what-if -f '.\main.bicep' -p 'main.bicepparam'
109+
```
110+
111+
or PowerShell
112+
113+
```powershell
114+
Connect-AzAccount
115+
Set-AzContext -Subscription "subscription name or id"
116+
New-AzResourceGroupDeployment -Confirm -ResourceGroup "your-rg" -TemplateFile "main.bicep" -TemplateParameterFile "main.bicepparam"
117+
```

‎bicep-examples/imports-exports/main.bicep‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
2+
targetScope = 'subscription'
3+
4+
// MARK: Imports
5+
import * as shared from 'shared.bicep'
6+
// import { location } as location from 'shared.bicep' to only import a specific var or type from the file.
7+
8+
// MARK: Variables
9+
var location = shared.location // using central value from shared.bicep
10+
var rgName = 'rg-bicepify-demo'
11+
var keyVaultName = 'kv-bicepify-demo'
12+
13+
// MARK: RBAC Entra import example
14+
module resourceGroupShared 'br/public:avm/res/resources/resource-group:0.4.1' = {
15+
name: '${uniqueString(deployment().name, location)}-${rgName}'
16+
params:{
17+
name: rgName
18+
location: location
19+
roleAssignments: [
20+
{
21+
principalId: shared.entraSecurityGroups.SG_Cloud_Team.objectId // Using imported Entra Security Group Object ID
22+
roleDefinitionIdOrName: 'Contributor'
23+
}
24+
]
25+
}
26+
}
27+
28+
// MARK: Key Vault
29+
module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
30+
name: '${uniqueString(deployment().name, location)}-${keyVaultName}'
31+
scope: resourceGroup(rgName)
32+
params: {
33+
name: keyVaultName
34+
location: location
35+
sku: 'standard'
36+
publicNetworkAccess: 'Disabled' // Selected Networking
37+
networkAcls: {
38+
defaultAction: 'Deny'
39+
bypass: 'AzureServices'
40+
virtualNetworkRules: []
41+
ipRules: [
42+
{
43+
value: shared.branchOfficePublicIP // using central import value from shared.bicep
44+
action: 'Allow'
45+
}
46+
]
47+
}
48+
}
49+
}

‎bicep-examples/imports-exports/shared.bicep‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
@export()
2+
@description('Common Entra Security Group(s) for RBAC')
3+
var entraSecurityGroups = {
4+
SG_Cloud_Team: {
5+
displayName: 'SG_Cloud_Team'
6+
objectId: '11111111-1111-1111-1111-111111111111'
7+
}
8+
SG_Security_Team: {
9+
displayName: 'SG_Security_Team'
10+
objectId: '22222222-2222-2222-2222-222222222222'
11+
}
12+
SG_Dev_Team: {
13+
displayName: 'SG_Dev_Team'
14+
objectId: '33333333-3333-3333-3333-333333333333'
15+
}
16+
}
17+
18+
@export()
19+
@description('The Primary Azure Region location')
20+
var location = 'uksouth'
21+
22+
@export()
23+
@description('Branch Office Public IP')
24+
var branchOfficePublicIP = '82.110.72.90'
25+
26+
@export()
27+
@description('Azure Websites Private DNS Zone FQDN')
28+
var azureWebsitesPrivateDnsZone = 'privatelink.azurewebsites.net'

0 commit comments

Comments
 (0)