Building Secure Architecture with Bicep.

Define a main Bicep file and a parameters folder with a dev json for environment values, enabling deployment to Azure of a log analytics workspace for application insights.

Deploy log analytics workspace and app insights using bicep, applying naming conventions with system short name and environment, linking app insights to the workspace and deploying both in one shot.

Build a bicep module for App Insights and Log Analytics, define location, system short name, and environment, then call the module from the main bicep to deploy.

Deploy Azure App Service plan and App Service to host your web application on Linux basic B1, a platform as a service, with a cost of $12 in East U.S.

Demonstrate deploying an app service plan and app service using a Bicep module, with plan config parameters, tags, identity, and environment-specific JSON files for dev and prod.

Connect the application service with App Insights by assigning the instrumentation key to app settings and using a union to preserve existing settings, then verify telemetry flows to App Insights.

Learn to store a SQL password secret in a key vault and grant an application service's system assigned identity read access via an access policy, following the minimal permissions principle.

deploy a key vault via a bicep module using environment, system short name, location, and tenant id; apply standard sku and enable deployment-time access, with policies deferred.

Add a secret to the key vault and reference it in the application service environment variable with a key vault reference; fix access denied by updating permissions in bicep.

Deploy access policies by granting the app service's system-assigned identity read access to key vault secrets and wiring an array of read-only principal IDs to the key vault module.

Learn how to configure key vault access policies with bicep, grant app service permissions (get and list), and address public networking to enhance key vault security.

Secure the key vault by restricting access to the VNet. Use a VNet with default and apps subnets, delegated to the app service, and cidr notation for IP ranges.

Deploy a VNet with Bicep by configuring the VNet Cidr and subnets in parameters, including the default subnet and the APS subnet delegated to server farms.

Add a private endpoint to the vnet to secure the key vault, deploy private dns with an a record, and enable app service vnet integration.

Deploy a private endpoint for the key vault by updating the VNet Bicep to output the VNet and subnet IDs, then disable public access and wire in private dns.

Enable VNet integration by linking the app service to a subnet delegated to server farms, route traffic through the VNet, and deploy changes with the Bicep module.

Add a storage account with a private endpoint to store files, use a unique IP address, and implement RBAC in Bicep while updating the key vault to RBAC.

Deploy a storage account with a private endpoint using bicep, disable public access, enforce role-based access control, and place the endpoint in the same subnet with a private dns zone.

Review the code that tests connectivity between a storage account and an app service using a blob service client with the default Azure credential and a system-assigned identity.

Assign granular permissions for a storage blob using the built-in blob data contributor role in bicep, linking a storage account to a service principal and validating access with test calls.

Review the target architecture and replicate the production environment with the same resources: storage account, key vault, and application service. Explore customizing hardware for the app service via bicep.

Add a production parameters.json and allowed environment input to enforce dev and prod names, plan VNet CIDRs to avoid IP clashes, and parameterize IPs for key vault and storage.