Optimize Azure Infrastructure as Code Deployments with VS Code

Key Takeaways

[Music] hi everyone and uh thank you so much for joining I can tell you from my own personal experience that authoring a book and Publishing a book is not only rainbows unicorns it is also uh struggles like this and so I learned along the way there are three important aspects and three important challenges to uh to take a look at uh one is the create process I needed the right tools me get started in authoring that book and second is deploy I found out there are lots of different ways to deploy or publish a book and lastly main thing I realized that a book is actually never finished especially when we're talking about an IT book so it requires continuous maintenance and it's these three topics that also apply to the session uh today which is all about infrastructure code for the Azure Cloud so the key takeaway of this session is to use your bicep for all of these three topics my name is f Bon I'm a product manager at parallels a Microsoft MVP and a published author and I enjoy sharing knowledge about infrastructure as code to help you deploy resources in Azure in a more faster and more efficient way so let's Dive Right In and start our Bap exercise to get everyone on the same page Bap is a infrastructure code language it allows you to deploy resources into Azure using a declarative approach and there's three important aspects that come into play when you uh take a look at b as infrastructure as code language one of them is that it's item components meaning that similar to how the same source code always generates the same binary the same template in turn will always generate the same environment in Azure so it's consistent a second it is declarative so that means that you basically State the end result of what you want to create rather than having imperative code where each line of code is processed individually so you do really care much about how things are deployed you are focusing on the end result of what you want to create and lastly it is fast so you basically provide your bicep file into the arm engine that you can see in the diagram on the right hand side here and the arm engine will then transpile your template into an actual arm template and by transpiling we mean taking one language the bicep language and turning that into another language and then that arm template is processed into the arm engine and using the concept of resource providers that will lead into different resources that you want to create whether that's related to storage or networking or aure firewall uh all of those resources and if you have experience with arm templates uh you can consider bicep as a abstraction layer on top of arm and on top of arm templates basically masking away all of the code complexity and making sure that you have a good experience and also the ability to reuse your code in various different ways so let's Dive Right In and take a look at step number one which is that create step so similar to how I needed the right tools to help me get started in writing that book you need the right tools to get started with BF infrastructures code and that is vs code and the vs code extension so let's Dive Right In and let me open up uh vs code to get us started so I have a bicep file here which is called create. bicep which is an file and let's take a look at how to get started from scratch so basically what I do is I type the keyword resource followed by symbolic name and I followed by the type of resource I want to create so in this case that's a storage account I can easily specify the API version I do an equal sign and say give me all the required properties so now I can fill in these things like for example this going to be Bill 24 the location is going to be West us and for the SK I have this nice drop down list to select the correct value as well as the kite so as you can see the um the bicep extension that's installed in vsod really helps me along in creating this template next if I want to make this more reusable I can create a parameter so I do the keyword PRM followed by the name so let's do for example location it's going to be a string and let's make that equal to West us again I can now take this valuable this parameter and change it to make make my template more reusable and have the location be uh variable if I want to do an output same thing I could do output I could say sa out for example and again this is going to be a string it's going to be equal to sa Dot and sa say dot is now a reference to the resource that I declared before so I can now say from the properties give me for example the AIS here and that's it we now declared our first storage account that we're able to deploy in azure sometimes uh that's even a greater way is also doing it the other way around so if I open up for example the Azure portal here and go to any uh random resource this applies to any resource I can open up the Json View and I can copy this resource ID which is the unique ID of my resource I can go back into my Bice set templates and anywhere basically write click and say insert resource paste the ID and within a couple of seconds we should see the bicep template so this is the bicep equivalent of we of the resource that we just saw in the Azure portal with all of the variables with all of the properties everything El so why is this interesting this allows me to reverse engineer to learn the code and start using bicep so the more resources you create the more you start to take a look at the use of modules and so modules is a concept that allows you to extract P of code and put them into separate module files so let's take a look so I have a subfolder here which called modules with a main dob file and similar we have parameters uh we have a resource being declared here but we also have a module which now starts with the keyword module followed by a symbolic name and followed by a bicep file so this bicep file is on my local file system and basically I'm saying to the arm engine any resource that's declared inside this module file deploy that and make sure to pass these parameters to it and by the way deploy that inside this scope so the concept of modules also allows me to deploy resources into multiple resource groups at the same time by defining the scope towards RG and of course RG is that symbolic name to the resource that we declared before in this case the module is on my local file system and for some scenarios that might be ideal for example if I am the only one creating and working on this template but let side I want to share it with my co-workers or colleagues or team members I can do that using a concept of azure container Registries and that looks like this so in this case the module is now stored in an ACR inside the Azure container registry and as a result I don't have to have it on my local file system but instead I point to BR which stands for bicep registry followed by a link and I followed by a version so now I'm able to use this uh module without having to have it locally with the ability to provide others access to it as well in this case you or the or the organization is responsible of course for maintaining that module and making sure that it's up to dat and gets um gets used in the proper way the other way you could do it is also making use of azure verified modules for short AVM so these are modules that are own developed supported and maintained by Microsoft so in this case you don't have to worry about the module itself you can just consume it as a public module so basically you do BR which stands from bicep registry again but now pointing to a public module and the version to use this module so as you can see various different ways of using modules to reuse your piece of code so the more resources you bring in the more modules you start to use the more probably will have to have uh some kind of visualization of what you are grading and you can do so using the bicep visualizer as you can see in the upper right corner so if you click on it you actually get this nice graphical interface graphical overview of all of the resources that that you are creating and as you can see it's interactive I can zoom in and I can drag these items around uh to make sure that makes sense to the need uh that I have whether that's documentation or explaining the code to someone else so really great way to uh to do that with options like zooming and reverting back to the defaults as well the last last tip I would say inside the create process is um decompiling so if you have an arm template or if you have experience with arm templates you probably have a repo different templates you used in the past and that's actually a really great way to decompile those back into bicep so basically right click them and say decompile into bicep and within the second I now have the bicep equivalent of this same file if I would do a side by-side comparison uh and zoom out a little bit not so much readable but you can probably take a look at the difference left and right when it comes to complexity left is bicep but none of the code complexity where right has all of the commas and and double quotes and all those things which makes it hard to read and to uh maintain so that was step number one the create step number two is deploy so uh similar to writing the book I needed to write tools but I also found out that there are lots of different ways to deploy that book and so uh it's the same thing with Bap there are lots of different ways to deploy it bicep template you can use the uh Azure devops gith up actions uh Powershell CLI and all of those options in this case I want to take a look at a very specific one which is actually also integrated into vs code which is the deployment pain so again let's switch to vs code and let's zoom in a little bit more and let's go to another uh example here so uh nothing we have not seen before so these are parameters and in this case I have three resources and an output that I want to deploy so of course what I could do is go ahead and take a look at the terminal here and say something like a daisy group create in order to deploy this template to Azure in this case we're going to take a look at the deployment Paine and again that's an icon in the upper right corner here and if I click it let me get these things out of the way I can start by defining the scope so I have a subscription ID and a resource here where I want to deploy the St and I can then change the parameters of this deployment so um I have the option to either pick a parameter file or actually change the parameters right from within this interface so for example if I don't want to deploy into West Europe what is that I want to deploy to the Moon let's see what uh what's going to happen so the reason I'm doing this is that there are a couple of actions inside this deployment pain as well one of those action is validate so if I click validate of course the template is now going to be validated against uh the scope that I selected and you probably guessed that um it is of course not able to do that right so the message here is to provide the location the Moon is not available for this resource time so let's change that back to the location West Europe do a validate again and we can see that it now succeeded this so this already helps me into validating the template against the uh scope that I defined more interestingly I can do what if and what a whatif does is it takes your template with the Scopes to see what is going to happen if you were to deploy this inside that location uh so not actually deploying it but providing you with some details on what to expect So within the second two there we go we have a result of that w action so we can see all of the resources the changes the properties uh that are going to be changed if I am to deploy this and lastly I can also of course deploy it right from within here so we're now contacting the Azure arm engine to deploy this template with the parameter file and also see the end result so here you go these resources were affected by this operation and here is the output uh ID that we also were requested so if I click on one of these items that's really great I can actually go directly into the ash portal and take a look at the resource that was created by the um by the extension here so a really great way to interact with uh with templates uh with the Azure Cloud so is that going to replace all of the different ways of deployment that you have today probably not because if you move to more production ready environment you'll probably take a look at things like Azure devops or GTO actions where you have a much more um of a production ready to deployment mechanism maybe um incorporating some devops and all those things however the deployment pain is really easy for a quick action if I'm developing something and I want to see the end result I can validate I can do what if and I can deploy towards for example a staging environment really quickly from within the vs Council and then lastly maintain so similar to writing the book I found out that a book is actually never finished it requires continuous maintenance and the same thing is true uh for your templates right so you're probably not creating templates to use them once you're going to reuse them again and a great way to maintain all of those templates and and resources is something that's called a deployment stack so a deployment stack is basically a logical grouping of multiple resources that you want to manage as a uh logical group as a whole so a couple of um advantages here for one it prevents anyone from accidentally deleting individual resources from that stack it's another way of securing those resources it also enforces you to maintain those resources as a whole as a logical group and it allows you to destroy all of those resources at the same time regardless if those are into the same Resource Group or even multiple resource groups or even multiple subscriptions so let's take a look and switch to vs code I take a look at uh example number three um so again I have a bicep file here with a couple of parameters and a couple of resources so let's say that I want to have these maintained as that logical group for that to start I first need uh the deployment stack and since the deployment stack is just any other Azure resource I can also deploy it using a visf template as you can see here we're not going to do that now we're going to take a look at another example is that using Azure C in this case I'm actually going to use this command here to deploy a deployment stack uh and it's we're going to require at that command let a stack group create I'm going to provide it a name I'm going to provide it a resource Group and I'm going to deply it um that template file and the template file is the file that I just showed you with the resources in it and I'm going to say deny delete and we'll touch upon what that means in just a second so the end result let me uh for the last time switch back to the aure portal and go to Resource groups into the stack resource groups uh here we have the option deployment stacks and as you can see this stack is already available here I deployed it earlier today and if I take a look we can see that uh we have different resources that are actually attached to this stack from here I have a couple of options one of those options is to delete the entire stack we talked about so I have three options here one of them is to detach the resources uh so not delete them the other option is to delete all the resources and detach the resource groups and the last one is destroying everything so that is removing all the resource groups and resources at the same time the other option here is to edit and redeploy so I can of course go into this stack here and and take a look at um uh detaching the resources changing the properties changing the templates and all of those things uh the last thing is that the leete option right so if I go into this uh uh deployment stack again and take a look at the deny settings I can see that deny delete is in fact configured so what does that mean if I go back into the resource Group itself and open up one of those individual resources and try to delete it let's see what happens and we get this error message here saying that yes I do have the permissions to delete it however access is denied because of that uh deployment stack that is configured for this resource so although I am an owner on the subscription I cannot delete it right so and that's another security mechanism to make sure that you're um redeploying those resources as part of that logical group so how would you then remove that resource if you wanted to you would go back to the original bicep file you would uh take this resource remove it from this bicep and then rerun that template uh deployment again and it will take a look at the the differences between your template file and between the stack and make sure that everything is up to date again so that's the last thing that I wanted to show you and that is uh the deployment uh stack so really ideal to make sure that all of the resources that are logical grouped are also maintained and secured as The Logical group so with that I want to thank you uh for your attention so this uh this demo was all about optimizing your Azure infrastructure as code experience with FS code and with the bicep extension in it so we took a look at the create the deploy and the maintain process for that so with that my name is fron and thank you so much for watching [Music] [Music]