What the Azure Bicep validator checks
The browser-based validator checks common Bicep authoring and review problems: unbalanced delimiters, missing resource declarations, secrets in ordinary parameters, hardcoded credentials, public storage access, permissive networking, weak TLS choices, and API versions that deserve review.
It also highlights maintainability improvements such as descriptions for parameters, modules for repeated patterns, environment tags, and a what-if review before deployment. Findings are grouped by severity so syntax concerns remain distinct from design recommendations.
Complete Bicep validation before deployment
Static browser checks cannot replace the Bicep compiler or Azure Resource Manager. Run the Bicep build and lint process using the version approved by your delivery pipeline. Then validate at the correct scope and run Azure what-if using the intended parameters and deployment identity.
Azure validation can identify resource-provider rules, policy conflicts, scope problems, invalid names, permissions, and dependencies that are unavailable to an offline checker. A successful validation still does not guarantee deployment because remote state, quotas, locks, or conditions can change.
- Compile and lint with the approved Bicep CLI version.
- Use @secure() for secret parameters and avoid secret outputs.
- Review what-if results for deletes, replacements, and ignored changes.
- Deploy first to a safe environment and verify the resulting resources.
Designing maintainable Bicep modules
Use modules to package resources with a clear purpose and stable interface. Keep required parameters small, return only useful outputs, and avoid exposing secrets. Pin external module versions and review changes before updating consumers.
Select API versions deliberately instead of changing them only to silence tooling. Newer versions can introduce properties or behavior changes, while old versions can lack required security features. Test every version change with build, validation, what-if, and a controlled deployment.
Frequently asked questions
Does this replace az bicep build?
No. It provides fast static checks. The official Bicep compiler is required for authoritative syntax and type validation.
Can it run Azure what-if?
No. What-if requires Azure authentication, the deployment scope, parameters, policies, and current resource state.
Is Bicep code uploaded?
No. The static checks run locally in the browser.