How to enforce Bicep Module-Only Deployments for Azure Resources

[ssijbabu]

Problem Statement
We have two distinct teams:

1. Module Development Team: Creates and maintains our standardized Bicep module templates.
2. Resource Consumption Team: Consumes these Bicep modules to deploy Azure resources.

Our current challenge is to strictly enforce that the Resource Consumption Team can only create Azure resources by utilizing the pre-approved Bicep module templates provided by the Module Development Team. They should not be able to directly deploy "raw" Azure resources that are natively available from Microsoft (e.g., creating a Storage Account or Virtual Machine directly without using our internal modules).

What are the most effective and robust strategies or best practices to achieve this enforcement?