05. Infrastructure as Code¶

Use Bicep to deploy repeatable, reviewable Azure infrastructure for your Java App Service workload.

flowchart TD
    INET[Internet] -->|HTTPS| WA["Web App\nApp Service S1\nLinux Java 17"]

    subgraph VNET["VNet 10.0.0.0/16"]
        subgraph INT_SUB["Integration Subnet 10.0.1.0/24\nDelegation: Microsoft.Web/serverFarms"]
            WA
        end
        subgraph PE_SUB["Private Endpoint Subnet 10.0.2.0/24"]
            PE_KV[PE: Key Vault]
            PE_SQL[PE: Azure SQL]
            PE_ST[PE: Storage]
        end
    end

    PE_KV --> KV[Key Vault]
    PE_SQL --> SQL[Azure SQL]
    PE_ST --> ST[Storage Account]

    subgraph DNS[Private DNS Zones]
        DNS_KV[privatelink.vaultcore.azure.net]
        DNS_SQL[privatelink.database.windows.net]
        DNS_ST[privatelink.blob.core.windows.net]
    end

    PE_KV -.-> DNS_KV
    PE_SQL -.-> DNS_SQL
    PE_ST -.-> DNS_ST

    WA -.->|System-Assigned MI| ENTRA[Microsoft Entra ID]
    WA --> AI[Application Insights]

    style WA fill:#0078d4,color:#fff
    style VNET fill:#E8F5E9,stroke:#4CAF50
    style DNS fill:#E3F2FD

Prerequisites¶

• Completed 02. First Deploy
• Azure CLI with Bicep support (az bicep version)
• Familiarity with resource groups and ARM deployments

What you'll learn¶

• How infra/main.bicep composes reusable modules
• How naming, parameters, and outputs are structured
• How to customize SKU, retention, and sampling safely
• How to validate deployments before production rollout

Main Content¶

Bicep architecture in this repository¶

flowchart TD
    M[main.bicep] --> LA[modules/log-analytics.bicep]
    M --> AI[modules/application-insights.bicep]
    M --> ASP[modules/appservice-plan.bicep]
    M --> WA[modules/webapp.bicep]
    AI --> LA
    WA --> ASP
    WA --> AI

main.bicep structure and intent¶

main.bicep defines:

• Parameters: baseName, location, appServicePlanSku, logAnalyticsRetentionDays, appInsightsSamplingPercentage
• Deterministic names using uniqueString(resourceGroup().id, baseName)
• Module composition for each major Azure resource
• Outputs consumed by deploy.sh (webAppName, webAppUrl, etc.)

Key parameter example¶

@description('App Service plan SKU (e.g., B1, S1).')
param appServicePlanSku string = 'B1'

@description('Log Analytics retention in days.')
@minValue(30)
@maxValue(730)
param logAnalyticsRetentionDays int = 30

These constraints prevent invalid retention values at deployment time.

Web app module highlights¶

modules/webapp.bicep sets critical platform-safe defaults:

• Linux runtime: JAVA|17-java17
• Health check path: /health
• Startup command: java -jar /home/site/wwwroot/*.jar --server.port=$PORT
• System-assigned managed identity enabled
• App Settings for profile and JVM tuning (SPRING_PROFILES_ACTIVE, JAVA_OPTS)

Deploy Bicep with explicit parameters¶

export RG="rg-appservice-java-guide"
export LOCATION="eastus"
export BASE_NAME="java-guide-iac"

az deployment group create \
  --resource-group "$RG" \
  --template-file "infra/main.bicep" \
  --parameters \
    baseName="$BASE_NAME" \
    location="$LOCATION" \
    appServicePlanSku="B1" \
    logAnalyticsRetentionDays=30 \
    appInsightsSamplingPercentage="100" \
  --output json

Customize for production¶

Common production deltas:

• appServicePlanSku: S1 or higher
• logAnalyticsRetentionDays: 90-365 (compliance dependent)
• appInsightsSamplingPercentage: reduce for high-volume apps (for example 25)

Example:

az deployment group create \
  --resource-group "$RG" \
  --template-file "infra/main.bicep" \
  --parameters \
    baseName="$BASE_NAME" \
    location="$LOCATION" \
    appServicePlanSku="S1" \
    logAnalyticsRetentionDays=120 \
    appInsightsSamplingPercentage="50" \
  --output table

Validate and preview changes¶

Run template validation before actual deployment:

az deployment group validate \
  --resource-group "$RG" \
  --template-file "infra/main.bicep" \
  --parameters baseName="$BASE_NAME" location="$LOCATION" \
  --output json

Use what-if for drift-safe planning:

az deployment group what-if \
  --resource-group "$RG" \
  --template-file "infra/main.bicep" \
  --parameters baseName="$BASE_NAME" location="$LOCATION" \
  --output json

Verification¶

• Deployment finishes with provisioningState: Succeeded
• Output includes a valid webAppUrl
• https://<web-app-host>/health returns HTTP 200
• App Service configuration reflects expected Bicep defaults

Troubleshooting¶

Bicep module path errors¶

Run deployment from repository root or ensure relative module paths in main.bicep remain unchanged.

Runtime mismatch after deploy¶

Check App Service runtime in portal or CLI; confirm linuxFxVersion is JAVA|17-java17.

Health check keeps failing¶

Confirm /health endpoint exists and startup command still forwards --server.port=$PORT.

CLI Alternative (No Bicep)¶

Use these commands when you need an imperative deployment path without changing the existing Bicep workflow.

Step 1: Set variables¶

RG="rg-springboot-tutorial"
LOCATION="koreacentral"
PLAN_NAME="plan-springboot-tutorial-s1"
APP_NAME="app-springboot-tutorial-abc123"
VNET_NAME="vnet-springboot-tutorial"
INTEGRATION_SUBNET_NAME="snet-appsvc-integration"

Variables prepared for rg-springboot-tutorial and app-springboot-tutorial-abc123.

Step 2: Create RG, plan, app¶

az group create --name $RG --location $LOCATION
az appservice plan create --resource-group $RG --name $PLAN_NAME --is-linux --sku S1
az webapp create --resource-group $RG --plan $PLAN_NAME --name $APP_NAME --runtime "JAVA|17-java17"

{
  "defaultHostName": "app-springboot-tutorial-abc123.azurewebsites.net",
  "state": "Running"
}

Step 3: Configure app settings and startup command¶

az webapp config appsettings set --resource-group $RG --name $APP_NAME --settings SCM_DO_BUILD_DURING_DEPLOYMENT=true SPRING_PROFILES_ACTIVE=production
az webapp config set --resource-group $RG --name $APP_NAME --startup-file "java -jar /home/site/wwwroot/app.jar --server.port=$PORT"

[
  {
    "name": "SCM_DO_BUILD_DURING_DEPLOYMENT",
    "value": "true"
  },
  {
    "name": "SPRING_PROFILES_ACTIVE",
    "value": "production"
  }
]

Step 4 (Optional): Add VNet integration¶

az network vnet create --resource-group $RG --name $VNET_NAME --location $LOCATION --address-prefixes 10.10.0.0/16
az network vnet subnet create --resource-group $RG --vnet-name $VNET_NAME --name $INTEGRATION_SUBNET_NAME --address-prefixes 10.10.1.0/24 --delegations Microsoft.Web/serverFarms
az webapp vnet-integration add --resource-group $RG --name $APP_NAME --vnet $VNET_NAME --subnet $INTEGRATION_SUBNET_NAME

{
  "isSwift": true,
  "subnetResourceId": "/subscriptions/<subscription-id>/resourceGroups/rg-springboot-tutorial/providers/Microsoft.Network/virtualNetworks/vnet-springboot-tutorial/subnets/snet-appsvc-integration"
}

Step 5: Validate effective configuration¶

az webapp config show --resource-group $RG --name $APP_NAME --query "{linuxFxVersion:linuxFxVersion, appCommandLine:appCommandLine}" --output json
az webapp config appsettings list --resource-group $RG --name $APP_NAME --query "[?name=='SCM_DO_BUILD_DURING_DEPLOYMENT' || name=='SPRING_PROFILES_ACTIVE']" --output json

{
  "linuxFxVersion": "JAVA|17-java17",
  "appCommandLine": "java -jar /home/site/wwwroot/app.jar --server.port=$PORT"
}

Run It in the Portal¶

Portal view: Resource group overview (verifying Bicep deployment outputs)¶

After running az deployment group create --template-file ./infra/main.bicep, the resource group overview is the Portal surface for checking what the deployment produced. The visible Resources tab shows how Azure inventories related resources as separate rows in one resource group, including App Service, App Service Plan, Application Insights, and other related rows the modular Bicep template provisions (for example a Log Analytics workspace). For this tutorial, use the same blade to confirm that the Spring Boot web app and plan created by your Bicep deployment exist, then open the Deployments entry in Essentials if you need to inspect deployment history after a partial failure. The Export template button is also useful when you want to compare deployed ARM state with the Bicep source in your repository.

See Also¶

• 06. CI/CD
• 07. Custom Domain & SSL
• Recipes: VNet Integration

Sources¶

• Deploy Bicep files by using Azure CLI
• Microsoft.Web/sites Bicep resource