iac-biceplisted

# Bicep / ARM Discipline The operational discipline for Bicep as the active IaC tool (Azure). Pairs with the `cloud-architecture-azure` pack (service-level detail) and the `azure-deployment-preflight` skill (the pre-deploy gate). Project file layout and resource-group/subscription facts come from `CLAUDE.md`. ## Core stance - **Infrastructure is software.** If it only works once, it doesn't work. "Just deploy it again" is not a strategy — understand *why* it failed. - **`bicep build` only checks syntax.** It does NOT catch invalid property combinations, metric names, KQL scope, secret-ref mismatches, or naming collisions. The real gate is `az deployment group validate` + `what-if` (see `azure-deployment-preflight`). - **Batch your fixes.** Each push triggers a long CI run — read the whole failing module, fix every issue, push once. One run per problem cluster, not one per error message. ## Project layout A conventional, recreatable structure (confirm exact paths in `CLAUDE.md`): ``` infrastructure/ main.bicep # orchestration: wires modules together, declares params modules/ # reusable modules, one concern each (db, acr, alerts, …) <concern>.bicep environments/ dev.bicepparam # per-env parameter files (preferred over .parameters.json) staging.bicepparam prod.bicepparam scripts/ # helper scripts (e.g. seed-keyvault.sh) ``` - **`main.bicep`** is the orchestrator: declare `param`s