Bicep in practice: modules, what-if, deployment stacks

Make a folder for this lesson and copy the NSG file from Lesson 41 in as a module:

New-Item -ItemType Directory -Path C:\azure-lab\bicep42\modules -Force | Out-Null
Set-Location C:\azure-lab\bicep42
(Get-Content C:\azure-lab\bicep\nsg.bicep) -replace "lesson: '41'", "lesson: '42'" | Set-Content modules\nsg.bicep
az group create --name rg-saat-l42 --location centralindia --tags course=saatvedha-azure lesson=42 -o none

1Write a second module

Save the route table module:

$r = @'
@description('Name of the route table')
param rtName string

@description('Azure region for the route table')
param location string = resourceGroup().location

resource rt 'Microsoft.Network/routeTables@2024-05-01' = {
  name: rtName
  location: location
  tags: {
    course: 'saatvedha-azure'
    lesson: '42'
  }
  properties: {
    disableBgpRoutePropagation: false
    routes: [
      {
        name: 'drop-onprem-range'
        properties: {
          addressPrefix: '10.80.0.0/16'
          nextHopType: 'None'
        }
      }
    ]
  }
}

output rtId string = rt.id
'@
Set-Content -Path modules\rt.bicep -Value $r

The route sends 10.80.0.0/16 (the future “on-premises” range from the course plan) to None, which drops it. It’s harmless here because the route table isn’t attached to any subnet.

2Write main.bicep to call both modules

Save it, plus a parameters file, and build:

$m = @'
@description('Short environment name used in resource names')
@allowed([
  'dev'
  'prod'
])
param env string = 'dev'

@minValue(100)
@maxValue(4096)
param httpsPriority int = 110

@description('Deploy the route table module')
param deployRouteTable bool = true

module nsg 'modules/nsg.bicep' = {
  name: 'nsg-${env}'
  params: {
    nsgName: 'nsg-saat-${env}'
    httpsPriority: httpsPriority
  }
}

module rt 'modules/rt.bicep' = if (deployRouteTable) {
  name: 'rt-${env}'
  params: {
    rtName: 'rt-saat-${env}'
  }
}

output nsgId string = nsg.outputs.nsgId
output rtId string = deployRouteTable ? rt!.outputs.rtId : 'none'
'@
Set-Content -Path main.bicep -Value $m
Set-Content -Path dev.bicepparam -Value "using 'main.bicep'`n`nparam env = 'dev'`nparam httpsPriority = 110"
az bicep build --file main.bicep
(Get-Content main.bicep).Count

You should see this (no errors or warnings):

31

3Deploy it as a deployment stack

Run this:

az stack group create --resource-group rg-saat-l42 --name stack-saat-l42 --template-file main.bicep --parameters dev.bicepparam --action-on-unmanage deleteResources --deny-settings-mode denyDelete --yes -o none
az stack group show --resource-group rg-saat-l42 --name stack-saat-l42 --query "{state:provisioningState, onUnmanage:actionOnUnmanage.resources, deny:denySettings.mode, managed:length(resources)}" -o table

You should see something like this:

State      OnUnmanage    Deny        Managed
---------  ------------  ----------  ---------
succeeded  delete        denyDelete  2

4Preview a change with what-if

Change the priority to 120 in the parameters file and preview, without deploying:

Set-Content -Path dev.bicepparam -Value "using 'main.bicep'`n`nparam env = 'dev'`nparam httpsPriority = 120"
az deployment group what-if --resource-group rg-saat-l42 --template-file main.bicep --parameters dev.bicepparam

You should see something like this at the end:

  ~ Microsoft.Network/networkSecurityGroups/nsg-saat-dev [2024-05-01]
    ~ properties.securityRules: [
      ~ 0:
        ~ properties.priority: 110 => 120
      ]

  = Microsoft.Network/routeTables/rt-saat-dev [2024-05-01]

Resource changes: 1 to modify, 1 no change.

One property on one resource changes, nothing is created or deleted. That’s the review you want before every production deployment. If what-if shows a Delete you didn’t expect, stop.

5Remove a module and let the stack clean up

Turn the route table off and update the stack:

Set-Content -Path dev.bicepparam -Value "using 'main.bicep'`n`nparam env = 'dev'`nparam httpsPriority = 120`nparam deployRouteTable = false"
az stack group create --resource-group rg-saat-l42 --name stack-saat-l42 --template-file main.bicep --parameters dev.bicepparam --action-on-unmanage deleteResources --deny-settings-mode denyDelete --yes -o none
az resource list --resource-group rg-saat-l42 --query "[].{name:name, type:type}" -o table

You should see this:

Name          Type
------------  ---------------------------------------
nsg-saat-dev  Microsoft.Network/networkSecurityGroups

The route table is gone. The stack noticed it no longer manages it and deleted it, because you chose deleteResources. With a normal deployment it would still be there.

Look at the files you now have: a main.bicep of 31 lines and two Bicep modules you can call from any other template. When a second team needs the same NSG standard, they call modules/nsg.bicep with their own name and priority instead of writing their own.

When many teams share Bicep modules, local paths stop working well. Publish the modules to a private Bicep registry with version numbers, so a team can stay on version 1.2 while you test 1.3. That one habit prevents most “it worked yesterday” template problems.

✅ Checkpoint: main.bicep calls two modules, what-if showed one change, and the stack deleted the route table when you removed it.