Bicep Module Index¶

Home | Main Bicep | Environments | Docs

Complete reference for all Bicep IaC modules in this POC. Each module is self-contained, parameterized, and designed for composition via main.bicep.

Last Updated: 2026-04-27 | Modules: 14 | Categories: 7

Table of Contents¶

• Architecture Overview
• Module Index
• Category: Fabric
• Category: Security
• Category: Storage
• Category: Monitoring
• Category: Networking
• Category: Governance
• Category: Analytics
• Deployment Examples
• Module Dependency Graph

Architecture Overview¶

main.bicep (orchestrator)
  |
  +-- fabric/fabric-capacity.bicep        Fabric F64 capacity
  +-- fabric/fabric-eventhouse.bicep       ADX cluster (Eventhouse backing)
  +-- fabric/fabric-eventstream.bicep      Event Hubs namespace (Eventstream backing)
  |
  +-- security/security.bicep             Key Vault + Managed Identity
  +-- security/workspace-identity.bicep   Workspace Identity (MI for Fabric)
  +-- security/resource-locks.bicep       CanNotDelete locks on critical resources
  |
  +-- storage/storage-account.bicep       ADLS Gen2 landing zone
  |
  +-- monitoring/log-analytics.bicep      Log Analytics workspace
  +-- monitoring/alerts-and-budgets.bicep CU alerts + budget alerts
  |
  +-- networking/vnet.bicep               VNet + subnets + NSGs
  +-- networking/private-endpoint.bicep   Shared PE module (reusable)
  |
  +-- governance/purview.bicep            Microsoft Purview account
  |
  +-- analytics/powerbi-workspace.bicep   Power BI Embedded capacity

Module Index¶

Category: Fabric¶

fabric-capacity.bicep¶

Deploys a Microsoft Fabric capacity with the specified SKU.

Parameters:

Outputs: capacityId, capacityName

fabric-eventhouse.bicep¶

Deploys an Azure Data Explorer (Kusto) cluster that mirrors the Eventhouse analytical capability. Since Eventhouse is a workspace-level artifact without a dedicated ARM resource type, this module provisions the backing ADX compute.

Parameters:

fabric-eventstream.bicep¶

Deploys an Azure Event Hubs namespace that powers Eventstream ingestion. Integrates with Fabric Eventstream as a custom input source.

Parameters:

Category: Security¶

security.bicep¶

Deploys Azure Key Vault and a User-Assigned Managed Identity for the POC. Supports private endpoints and HSM-backed keys (premium SKU for PCI-DSS/FedRAMP).

Parameters:

Outputs: keyVaultId, managedIdentityPrincipalId, managedIdentityClientId

workspace-identity.bicep¶

Deploys a user-assigned managed identity scoped for Fabric workspace identity scenarios. Enables credential-free auth to Azure resources (Key Vault, Storage, Purview).

Parameters:

Outputs: identityId, identityPrincipalId, identityClientId

resource-locks.bicep¶

Deploys CanNotDelete locks on critical infrastructure resources to prevent accidental deletion.

Parameters:

Category: Storage¶

storage-account.bicep¶

Deploys an ADLS Gen2 storage account for the landing zone. Supports private endpoints, CMK encryption, and RBAC assignment for the managed identity.

Parameters:

Outputs: storageAccountId, storageAccountName, primaryEndpoint

Category: Monitoring¶

log-analytics.bicep¶

Deploys a Log Analytics workspace for centralized monitoring. HIPAA/NIGC MICS workloads should set retention >= 2190 days (6 years).

Parameters:

Outputs: workspaceId, customerId

alerts-and-budgets.bicep¶

Deploys Azure Monitor alert rules for capacity utilization and budget alerts for cost governance.

Parameters:

Category: Networking¶

vnet.bicep¶

Deploys a Virtual Network with subnets and NSGs for private endpoint isolation.

Parameters:

Outputs: vnetId, privateEndpointSubnetId

private-endpoint.bicep¶

Reusable module that creates a private endpoint with DNS zone, VNet link, and DNS zone group. Called by other modules that support private endpoints.

Parameters:

Category: Governance¶

purview.bicep¶

Deploys a Microsoft Purview account for data governance, lineage tracking, and data catalog.

Parameters:

Outputs: purviewAccountId, purviewAccountName

Category: Analytics¶

powerbi-workspace.bicep¶

Deploys a Power BI Embedded capacity that backs Fabric workspaces. Workspace creation and content deployment are handled via the Power BI REST API post-deployment.

Parameters:

Deployment Examples¶

Full POC Deployment (dev)¶

# What-if analysis
az deployment sub what-if --location eastus2 \
  --template-file infra/main.bicep \
  --parameters infra/environments/dev/dev.bicepparam

# Deploy
az deployment sub create --location eastus2 \
  --template-file infra/main.bicep \
  --parameters infra/environments/dev/dev.bicepparam

Single Module Deployment¶

# Deploy just the Fabric capacity
az deployment group create \
  --resource-group rg-fabric-poc-dev \
  --template-file infra/modules/fabric/fabric-capacity.bicep \
  --parameters capacityName=fabric-poc-dev skuName=F64 adminEmail=admin@contoso.com location=eastus2

Compliance-Enhanced Deployment¶

# Deploy with CMK, private endpoints, and extended retention
az deployment sub create --location eastus2 \
  --template-file infra/main.bicep \
  --parameters infra/environments/prod/prod.bicepparam \
  # prod.bicepparam sets:
  #   enableCmk = true
  #   enablePrivateEndpoints = true
  #   logRetentionDays = 2190  (6 years for HIPAA)
  #   keyVaultSku = 'premium'  (HSM-backed for PCI-DSS)

Module Dependency Graph¶

flowchart TD
    M[main.bicep] --> LA[log-analytics]
    M --> VN[vnet]
    M --> SEC[security]
    M --> FC[fabric-capacity]

    LA --> SEC
    LA --> SA[storage-account]
    LA --> PV[purview]
    LA --> AB[alerts-and-budgets]

    SEC --> SA
    SEC --> WI[workspace-identity]

    VN --> PE[private-endpoint]
    PE --> SA
    PE --> SEC
    PE --> PV
    PE --> LA

    FC --> EH[fabric-eventhouse]
    FC --> ES[fabric-eventstream]
    FC --> PBI[powerbi-workspace]

    SA --> RL[resource-locks]
    SEC --> RL
    FC --> RL
    LA --> RL
    PV --> RL

Related Resources¶

Back to Top | Main README