小型电商团队的 Bicep 安全检查

促销周末前，小型电商团队不能因为去年的 Bicep 文件能跑，就直接推到生产。main.bicep 可能修改 Storage、App Service、Key Vault、支付 key、public access 和 SKU。没有检查 scope、secret 和 what-if，问题会在流量最高时出现。

Key Points

• 检查 scope、parameters、secrets、public access、成本和 rollback。
• Bicep 可读，但短文件也会影响生产。
• what-if 是部署前查看变化的入口。
• Claude Code 准备表格，人来批准。
• 观察 what-if 拦下的项目、明文 secret、公开设置和 review 时间。

Workflow: Review Bicep Before Deploy

先看 main.bicep、parameters、环境、resource group、what-if 和 rollback note。交给 Claude Code 前，先删除 secret 值。

Source	Review field	Human decision
Scope	resource group, subscription	production impact
Parameters	SKU, location, secret-like names	cost and payment safety
Resources	storage, web app, key vault	public access and customer impact
What-if	Create, Modify, Delete	deploy approval
Rollback	owner, stop note	sale-day response

Primary sources checked: Bicep overview, file structure, best practices, what-if, secure parameters, modules, and Azure CLI deploy.

What Claude Code Does And What Humans Decide

Claude Code can list resources, parameters, modules, public settings, secret-like names, and what-if risks. Humans decide production deploy, deletion, SKU, payment keys, customer data, public URL, firewall, cost, and rollback.

3 Use Cases

Use case 1: Read scope before production

• Input: main.bicep, resource group, subscription, environment, existing resources.
• Output: create/modify/delete table, scope, resource type, business impact.
• Human review: production target, SKU, region, public URL, deletion, payment resources.

Use case 2: Find risky parameters

• Input: parameters, parameter file, Key Vault use, connection string names.
• Output: secure parameter candidates, plain secret candidates, Key Vault candidates.
• Human review: payment key, email key, database string, customer data, admin password.

Use case 3: Read what-if output

• Input: what-if output, deployment date, rollback note, owner.
• Output: Create/Modify/Delete table, stop condition, approver.
• Human review: Delete, Replace, SKU, public access, cost, sale impact.

Copy-Paste Prompt

Act as an Azure Bicep safety reviewer for a small ecommerce team.
Turn Bicep files into a human deployment review table.
Check targetScope, secret-like parameters, public access, HTTPS, managed identity, what-if Delete/Replace/SKU changes, and rollback notes.
Never run deployment commands.
Return the five rows to inspect today.

Working Check Code

// verify-bicep-safety-notes.mjs
// No dependencies. Run with: node verify-bicep-safety-notes.mjs
const bicepReview = {
  template: "main.bicep",
  environment: "prod",
  scope: "subscription",
  resources: [
    { type: "Microsoft.Storage/storageAccounts", name: "ecprodstore", publicNetworkAccess: "Enabled", sku: "Standard_LRS" },
    { type: "Microsoft.Web/sites", name: "ec-sale-app", httpsOnly: false, managedIdentity: false },
    { type: "Microsoft.KeyVault/vaults/secrets", name: "payment-api-key", valueFromParameter: "plainTextPaymentKey" }
  ],
  parameters: [
    { name: "location", secure: false, valueExample: "japaneast" },
    { name: "plainTextPaymentKey", secure: false, valueExample: "sk_live_example" }
  ],
  whatIfAttached: false,
  owner: "",
  rollbackNote: ""
};

const problems = [];

if (bicepReview.environment === "prod" && !bicepReview.whatIfAttached) {
  problems.push({ item: "what-if", fix: "attach az deployment what-if output before production deployment" });
}
if (!bicepReview.owner) {
  problems.push({ item: "owner", fix: "assign a human owner for cost, rollback, and approval" });
}
if (!bicepReview.rollbackNote) {
  problems.push({ item: "rollback", fix: "write a rollback or stop-the-line note before sale season" });
}
for (const parameter of bicepReview.parameters) {
  if (/key|secret|password|token/i.test(parameter.name) && !parameter.secure) {
    problems.push({ item: `parameter: ${parameter.name}`, fix: "mark secrets with @secure() or fetch from Key Vault" });
  }
}
for (const resource of bicepReview.resources) {
  if (resource.publicNetworkAccess === "Enabled") {
    problems.push({ item: `public network: ${resource.name}`, fix: "review public access, firewall, private endpoint, or business reason" });
  }
  if (resource.httpsOnly === false) {
    problems.push({ item: `httpsOnly: ${resource.name}`, fix: "enable HTTPS-only before customer traffic" });
  }
  if (resource.type === "Microsoft.Web/sites" && resource.managedIdentity === false) {
    problems.push({ item: `identity: ${resource.name}`, fix: "use managed identity instead of app secrets when possible" });
  }
}

if (problems.length > 0) {
  console.table(problems);
  process.exitCode = 1;
} else {
  console.log("Bicep safety review passed.");
}

Pitfall: Common Failure Cases

Readable Bicep is not automatically safe. Review scope, what-if, secrets, public settings, and rollback. Do not place secrets in plain parameters. Do not run what-if and ignore Delete, Replace, SKU, public access, identity, or diagnostics. Do not deploy before sale season without an owner and rollback note.

FAQ

Q. Does a small EC team need Bicep?

A. Start only where changes repeat: sale pages, image delivery, admin apps, and staging environments.

Q. Can Claude Code read Bicep?

A. Yes, after removing secrets, tokens, customer data, and contract details.

Q. Is what-if enough?

A. No. Humans still approve deletion, replacement, SKU, public access, secrets, and rollback.

Q. What should the team inspect today?

A. targetScope, secret-like parameters, public access, what-if Delete/Modify, and rollback note.

Training And Consultation Signal

Measure what-if items stopped, plain secret candidates, public-setting findings, missing rollback notes, review time, and inquiry rate. If those numbers hurt, Bicep and Azure deployment review are a fit for ClaudeCodeLab training.

What I Verified

I checked Microsoft Learn references for Bicep overview, file structure, best practices, what-if, secure parameters, modules, and Azure CLI deployment. I also checked the CTA, executable JavaScript, internal link, external links, locale coverage, and queue removal.