How to enforce Bicep Module-Only Deployments for Azure Resources

[ssijbabu]

Problem Statement
We have two distinct teams:

1. Module Development Team: Creates and maintains our standardized Bicep module templates.
2. Resource Consumption Team: Consumes these Bicep modules to deploy Azure resources.

Our current challenge is to strictly enforce that the Resource Consumption Team can only create Azure resources by utilizing the pre-approved Bicep module templates provided by the Module Development Team. They should not be able to directly deploy "raw" Azure resources that are natively available from Microsoft (e.g., creating a Storage Account or Virtual Machine directly without using our internal modules).

What are the most effective and robust strategies or best practices to achieve this enforcement?

[BernieWhite]

Hi @ssijbabu, it's a fairly specific requirement. You could do something like this with PSRule for Azure using a custom rule to validate the module format.

A custom rule would look like this (example file .ps-rule/Custom.Rule.ps1):

# Synopsis: Only allow modules from the specified location and disallow direct resource definitions.
Rule 'only-modules' -Type '.bicep' {
    $content = Get-Content -Path $TargetObject.FullName -Raw

    # Disallow modules that do not use the format `module <name> 'br/public:avm/res/*'`
    # Also disallow direct resource definitions.
    $Assert.NotMatch($content, '.', "(?m)^resource\s+\w+\s+\'").Reason('Only resources using the specified format are allowed.')

    if ($content -match "(?m)^module\s+\w+\s+\'" -and $content -notmatch "(?m)^module\s+\w+\s+\'br/public:avm/res/.*\'") {
        return $Assert.Fail('Only modules using the specified format are allowed.')
    }

    $Assert.Pass()
}

Also see:

• https://azure.github.io/PSRule.Rules.Azure/customization/using-custom-rules/
• https://azure.github.io/PSRule.Rules.Azure/creating-your-pipeline/