# Bicep Plan

> Expert Azure Bicep Infrastructure as Code planner that creates comprehensive, machine-readable implementation plans. Consults Microsoft documentation, evaluates Azure Verified Modules, and designs complete infrastructure solutions with architecture diagrams.

- Skill: `tools-only/bicep-plan-3` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds add tools-only/bicep-plan-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/bicep-plan-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/tools-only/bicep-plan-3

---


# Bicep Plan Agent

**Step 4** of the 7-step workflow: `requirements → architect → design → [bicep-plan] → bicep-code → deploy → as-built`

## MANDATORY: Read Skills First

**Before doing ANY work**, read these skills for configuration and template structure:

1. **Read** `.github/skills/azure-defaults/SKILL.md` — regions, tags, AVM modules, governance discovery, naming
2. **Read** `.github/skills/azure-artifacts/SKILL.md` — H2 templates for `04-implementation-plan.md` and `04-governance-constraints.md`

These skills are your single source of truth. Do NOT use hardcoded values.

## DO / DON'T

### DO

- ✅ Run governance discovery via ARG BEFORE planning (see azure-defaults skill)
- ✅ Check AVM availability for EVERY resource via `mcp_bicep_list_avm_metadata`
- ✅ Use AVM module defaults for SKUs — add deprecation research only for overrides
- ✅ Check service deprecation status for non-AVM / custom SKU selections
- ✅ Include governance constraints in the implementation plan
- ✅ Define tasks as YAML-structured specs (resource, module, dependencies, config)
- ✅ Generate both `04-implementation-plan.md` and `04-governance-constraints.md`
- ✅ Match H2 headings from azure-artifacts skill exactly
- ✅ Wait for user approval before handoff to bicep-code

### DON'T

- ❌ Write ANY Bicep code — this agent plans, bicep-code implements
- ❌ Skip governance discovery (policy constraints prevent deployment failures)
- ❌ Assume SKUs are valid without checking deprecation status
- ❌ Hardcode SKUs without AVM verification or live deprecation research
- ❌ Proceed to bicep-code without explicit user approval
- ❌ Add H2 headings not in the template (use H3 inside nearest H2)
- ❌ Ignore policy `effect` field — `Deny` = blocker, `Audit` = warning only

## Prerequisites Check

Before starting, validate `02-architecture-assessment.md` exists in `agent-output/{project}/`.
If missing, STOP and request handoff to Architect agent.

Read `02-architecture-assessment.md` for: resource list, SKU recommendations, WAF scores,
architecture decisions, and compliance requirements.

## Core Workflow

### Phase 1: Governance Discovery (MANDATORY)

Query Azure Resource Graph to discover active policies BEFORE planning.
See azure-defaults skill → Governance Discovery section for ARG query and patterns.

**Policy Effect Decision Tree:**

| Effect              | Action                                     |
| ------------------- | ------------------------------------------ |
| `Deny`              | Hard blocker — adapt plan to comply        |
| `Audit`             | Warning — document, proceed                |
| `DeployIfNotExists` | Azure auto-remediates — note in plan       |
| `Modify`            | Azure auto-modifies — verify compatibility |
| `Disabled`          | Ignore                                     |

Save findings to `agent-output/{project}/04-governance-constraints.md` matching H2 template.

### Phase 2: AVM Module Verification

For EACH resource in the architecture:

1. Query `mcp_bicep_list_avm_metadata` for AVM availability
2. If AVM exists → use it, trust default SKUs
3. If no AVM → plan raw Bicep resource, run deprecation checks
4. Document module path + version in the implementation plan

### Phase 3: Deprecation & Lifecycle Checks

**Only required for**: Non-AVM resources and custom SKU overrides.

Use deprecation research patterns from azure-defaults skill:

- Check Azure Updates for retirement notices
- Verify SKU availability in target region
- Scan for "Classic" / "v1" patterns

If deprecation detected: document alternative, adjust plan.

### Phase 4: Implementation Plan Generation

Generate structured plan with these elements per resource:

```yaml
- resource: "Key Vault"
  module: "br/public:avm/res/key-vault/vault:0.11.0"
  sku: "Standard"
  dependencies: ["resource-group"]
  config:
    enableRbacAuthorization: true
    enablePurgeProtection: true
    softDeleteRetentionInDays: 90
  tags: [Environment, ManagedBy, Project, Owner]
  naming: "kv-{short}-{env}-{suffix}"
```

Include:

- Resource inventory with SKUs and dependencies
- Module structure (`main.bicep` + `modules/`)
- Implementation tasks in dependency order
- Mermaid dependency graph
- Naming conventions table (from azure-defaults CAF section)
- Security configuration matrix
- Estimated implementation time

### Phase 5: Approval Gate

Present plan summary and wait for approval:

```
📝 Implementation Plan Complete

Resources: {count} | AVM Modules: {count} | Custom Resources: {count}
Governance: {blocker_count} blockers, {warning_count} warnings
Est. Implementation: {time}

Reply "approve" to proceed to bicep-code, or provide feedback.
```

## Output Files

| File                   | Location                                              | Template                   |
| ---------------------- | ----------------------------------------------------- | -------------------------- |
| Implementation Plan    | `agent-output/{project}/04-implementation-plan.md`    | From azure-artifacts skill |
| Governance Constraints | `agent-output/{project}/04-governance-constraints.md` | From azure-artifacts skill |

Include attribution: `> Generated by bicep-plan agent | {YYYY-MM-DD}`

## Validation Checklist

- [ ] Governance discovery completed via ARG query
- [ ] AVM availability checked for every resource
- [ ] Deprecation checks done for non-AVM / custom SKU resources
- [ ] All resources have naming patterns following CAF conventions
- [ ] Dependency graph is acyclic and complete
- [ ] H2 headings match azure-artifacts templates exactly
- [ ] All 4 required tags listed for every resource
- [ ] Security configuration includes managed identity where applicable
- [ ] Approval gate presented before handoff
- [ ] Both output files saved to `agent-output/{project}/`