# 💻 Step 5: Implementation Reference - Malta Catering

![Step](https://img.shields.io/badge/Step-5-blue?style=for-the-badge)
![Status](https://img.shields.io/badge/Status-Complete-success?style=for-the-badge)
![Agent](https://img.shields.io/badge/Agent-Bicep%20Code-purple?style=for-the-badge)

<details open>
<summary><strong>📑 Implementation Reference</strong></summary>

- [📁 IaC Templates Location](#-iac-templates-location)
- [🗂️ File Structure](#-file-structure)
- [✅ Validation Status](#-validation-status)
- [🏗️ Resources Created](#-resources-created)
- [🚀 Deployment Instructions](#-deployment-instructions)
- [📝 Key Implementation Notes](#-key-implementation-notes)

</details>

> Generated by bicep-code agent | 2026-04-14

| ⬅️ Previous                                    | 📑 Index            | Next ➡️                                              |
| ---------------------------------------------- | ------------------- | ---------------------------------------------------- |
| [04-preflight-check.md](04-preflight-check.md) | [README](README.md) | [06-deployment-summary.md](06-deployment-summary.md) |

## 📁 IaC Templates Location

📁 **Code Location**: [`infra/bicep/malta-catering/`](../../infra/bicep/malta-catering/)

## 🗂️ File Structure

```text
infra/bicep/malta-catering/
├── main.bicep
├── main.bicepparam
├── azure.yaml
├── deploy.ps1
└── modules/
    ├── app-insights.bicep
    ├── app-service-plan.bicep
    ├── budget.bicep
    ├── container-registry.bicep
    ├── key-vault.bicep
    ├── log-analytics.bicep
    ├── private-dns-zones.bicep
    ├── storage.bicep
    ├── virtual-network.bicep
    └── web-app.bicep
```

## ✅ Validation Status

| Check                            | Result | Details                                                                        |
| -------------------------------- | ------ | ------------------------------------------------------------------------------ |
| `bicep build`                    | ✅     | Passed with no blocking errors.                                                |
| `bicep lint`                     | ✅     | Passed. No local lint violations remain.                                       |
| `validate:iac-security-baseline` | ✅     | Passed after resolving tag casing and public network access hard gates.        |
| `lint:artifact-templates`        | ✅     | Passed with one non-blocking documentation warning addressed in this artifact. |
| `what-if`                        | ⏭️     | Deferred to Step 6 deployment workflow.                                        |

## 🏗️ Resources Created

~12 resources provisioned across networking, compute, data, security, and monitoring.

| Resource                     | Bicep Type                                 | Module                             |
| ---------------------------- | ------------------------------------------ | ---------------------------------- |
| Log Analytics Workspace      | `Microsoft.OperationalInsights/workspaces` | `modules/log-analytics.bicep`      |
| Application Insights         | `Microsoft.Insights/components`            | `modules/app-insights.bicep`       |
| Key Vault + secret           | `Microsoft.KeyVault/vaults`                | `modules/key-vault.bicep`          |
| Storage Account + tables     | `Microsoft.Storage/storageAccounts`        | `modules/storage.bicep`            |
| Container Registry (Premium) | `Microsoft.ContainerRegistry/registries`   | `modules/container-registry.bicep` |
| Virtual Network + subnets    | `Microsoft.Network/virtualNetworks`        | `modules/virtual-network.bicep`    |
| App Service Plan (S1)        | `Microsoft.Web/serverfarms`                | `modules/app-service-plan.bicep`   |
| Web App + staging slot + MI  | `Microsoft.Web/sites`                      | `modules/web-app.bicep`            |
| Private DNS Zones            | `Microsoft.Network/privateDnsZones`        | `modules/private-dns-zones.bicep`  |
| Private Endpoints            | `Microsoft.Network/privateEndpoints`       | `modules/web-app.bicep`            |
| Consumption Budget           | `Microsoft.Consumption/budgets`            | `modules/budget.bicep`             |

### AVM Module Versions

| AVM Module                               | Version |
| ---------------------------------------- | ------- |
| `avm/res/operational-insights/workspace` | latest  |
| `avm/res/insights/component`             | latest  |
| `avm/res/key-vault/vault`                | latest  |
| `avm/res/storage/storage-account`        | latest  |
| `avm/res/container-registry/registry`    | latest  |
| `avm/res/network/virtual-network`        | 0.7.0   |
| `avm/res/web/serverfarm`                 | 0.4.0   |
| `avm/res/web/site`                       | 0.15.0  |
| `avm/res/network/private-dns-zone`       | 0.7.0   |

```mermaid
%%{init: {'theme':'neutral'}}%%
graph TD
    MAIN["main.bicep"] --> LAW["log-analytics"]
    MAIN --> APPI["app-insights"]
    MAIN --> KV["key-vault"]
    MAIN --> ST["storage"]
    MAIN --> ACR["container-registry"]
    MAIN --> VNET["virtual-network"]
    MAIN --> ASP["app-service-plan"]
    MAIN --> WEBAPP["web-app"]
    MAIN --> DNS["private-dns-zones"]
    MAIN --> BUDGET["budget"]
    LAW --> APPI
    LAW --> KV
    LAW --> ST
    LAW --> ACR
    APPI --> KV
    VNET --> WEBAPP
    ASP --> WEBAPP
    KV --> WEBAPP
    ST --> WEBAPP
    ACR --> WEBAPP
    WEBAPP --> DNS
```

## 🚀 Deployment Instructions

<details>
<summary><strong>🟢 Quick Deploy (PowerShell)</strong></summary>

```powershell
cd infra/bicep/malta-catering
./deploy.ps1 -Owner "team@example.com" -CostCenter "demo-001" -TechnicalContact "ops@example.com" -BudgetContactEmails "ops@example.com"
```

</details>

<details>
<summary><strong>🔍 Preview Changes (What-If)</strong></summary>

```powershell
./deploy.ps1 -Owner "team@example.com" -CostCenter "demo-001" -TechnicalContact "ops@example.com" -BudgetContactEmails "ops@example.com" -WhatIfDeployment
```

</details>

<details>
<summary><strong>⚙️ Custom Parameters</strong></summary>

```powershell
./deploy.ps1 `
    -ResourceGroupName "rg-malta-catering-dev" `
    -Location "swedencentral" `
    -Environment "dev" `
    -Phase "compute"
```

</details>

<details>
<summary><strong>🚀 Azure CLI</strong></summary>

```bash
az deployment group create \
  --resource-group rg-malta-catering-dev \
  --template-file infra/bicep/malta-catering/main.bicep \
  --parameters infra/bicep/malta-catering/main.bicepparam \
  --parameters phase=all owner=team@example.com costcenter=demo-001 technicalContact=ops@example.com budgetContactEmails='["ops@example.com"]'
```

</details>

## 📝 Key Implementation Notes

| Note                                                                                                                                             | Impact                                                                            | Reference                                          |
| ------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | -------------------------------------------------- |
| `uniqueSuffix` is generated once and reused for globally unique names.                                                                           | Stable naming across Key Vault, Storage, and ACR.                                 | `main.bicep`                                       |
| Phase selection includes prerequisites implicitly in code ordering (foundation → networking → security-data-images → compute → cost-monitoring). | Later phases can redeploy safely without broken outputs.                          | `main.bicep`                                       |
| Resource-group deny-policy tags are applied in `deploy.ps1` before Bicep runs.                                                                   | Prevents hard-fail on first deployment.                                           | `deploy.ps1`                                       |
| Key Vault stores the Application Insights connection string for the Web App to resolve through managed identity.                                 | Avoids inline secret values in Web App configuration.                             | `modules/key-vault.bicep`, `modules/web-app.bicep` |
| Web App RBAC is created after the app identity exists.                                                                                           | Grants `AcrPull`, `Key Vault Secrets User`, and `Storage Table Data Contributor`. | `modules/web-app.bicep`                            |

```bicep
var uniqueSuffix = take(toLower(uniqueString(resourceGroup().id)), 6)
```

❌ No blocking Step 5 validation failures remain.

---

_Implementation reference generated from Bicep templates._

---

<div align="center">

| ⬅️ [04-preflight-check.md](04-preflight-check.md) | 🏠 [Project Index](README.md) | ➡️ [06-deployment-summary.md](06-deployment-summary.md) |
| ------------------------------------------------- | ----------------------------- | ------------------------------------------------------- |

</div>
