Bicep Policy Compliance Instructions

Bicep Policy Compliance Instructions

First Principle: Azure Policy always wins. Current Azure Policy implementation cannot be changed. Code MUST adapt to policy, never the reverse.

Mandate

ALL Bicep code generation MUST cross-reference 04-governance-constraints.md and 04-governance-constraints.json before writing templates. These artifacts contain the discovered Azure Policy constraints for the target subscription.

Dynamic Tag List

Tags MUST come from governance constraints, not hardcoded defaults. The 4 baseline defaults in bicep-code-best-practices.instructions.md (Environment, ManagedBy, Project, Owner) are a MINIMUM — discovered policies always win. If governance constraints specify 9 tags, the Bicep code MUST include all 9.

Example

Defaults (azure-defaults skill):  4 tags
Governance constraints discovered: 9 tags (environment, owner,
  costcenter, application, workload, sla, backup-policy,
  maint-window, tech-contact)
Required in Bicep code:           9 tags (governance wins)

Policy Compliance Checklist

For every policy in 04-governance-constraints.json:

Deny Policies

• Prefer azurePropertyPath from JSON; fall back to bicepPropertyPath if absent
• Translate azurePropertyPath to Bicep ARM property: drop the leading resource-type segment (e.g. storageAccount.) and use the remainder as the ARM property path
• Extract requiredValue and verify the generated Bicep code sets the property to that value
• If the property is missing from Bicep code, add it
• If the property value conflicts, change it to match policy

Modify Policies

• Document expected auto-modifications in the implementation reference
• Do NOT set values that Modify policies auto-apply (avoid conflicts)

DeployIfNotExists Policies

• Document auto-deployed resources in the implementation reference
• Include expected resources in cost estimates

Audit Policies

• Document compliance expectations
• Set compliant values where feasible (best effort)

Enforcement Rule

[!CAUTION] Azure Policy always wins. Current Azure Policy implementation cannot be changed. Code MUST adapt to policy, never the reverse. A governance compliance failure is a HARD GATE — the Bicep Code Generator MUST NOT proceed past Phase 1.5 with unresolved policy violations.

Anti-Patterns

Cross-References

• Governance constraints artifact: agent-output/{project}/04-governance-constraints.md
• Governance constraints JSON: agent-output/{project}/04-governance-constraints.json
• Governance discovery instructions: .github/instructions/governance-discovery.instructions.md
• Azure defaults (baseline tags): .github/skills/azure-defaults/SKILL.md
• Bicep best practices: .github/instructions/bicep-code-best-practices.instructions.md