With changes in the world of cloud computing occurring seemingly every day, managing your SDLC’s security and infrastructure becomes more critical and challenging to keep up with.
Microsoft Azure, being a frontrunner in cloud services, provides two key tools for Infrastructure as Code (IaC): Azure Resource Manager (ARM) templates and its successor, Bicep. While both serve the same fundamental purpose, they take different routes to get there. We’ll explore the essence of Azure ARM and Bicep, shedding light on their roles in shaping the infrastructure deployment process.
Microsoft’s Nudge: Bicep as The Preferred Choice
Firstly, it’s important to note that in its quest for streamlining and enhancing user experiences, Microsoft seems to be steering towards Bicep as the preferred tool for Infrastructure as Code. Their proactive engagement with the developer community, mention on Bicep FAQs of Bicep improving the authoring experience, and the consistent updates and enhancements to Bicep, hint at a strategic push towards this new, more developer-friendly tool.
ARM vs Bicep
While using Azure infrastructure orchestration, choosing between ARM templates and Bicep comes down to weighing up the team’s abilities. ARM templates provide a robust, declarative way to define Azure resources, which people familiar with may be reluctant to leave after investing so much time in learning. However, writing and maintaining complex ARM templates can resemble crafting intricate blueprints for those not well-versed in the syntax of ARM and JSON.
With Bicep, Microsoft’s attempt to simplify the IaC landscape, there is a higher level of abstraction over ARM, offering a cleaner syntax and improved readability. While this is fantastic for simplicity, this abstraction may pose challenges for those who prefer the more verbose methods of ARM. Bicep allows developers to grasp the essentials more swiftly; it especially helps that Bicep syntax resembles other programming languages, which helps onboard new learners.
When it comes down to looking at the differences between these two approaches, aside from the differences in syntax, they perform in much the same way, with Bicep being able to do everything that ARM is capable of.
On Microsoft Bicep Playground, you can get a real-life demonstration of the differences between total line counts with various samples. The above example shows the “microsoft.cdn/cdn-with-web-app/main.bicep” template, with the Bicep total line count at 92 compared to 145 in ARM.
It’s worth noting that Azure CLI offers a built-in way to decompile ARM templates into Bicep:
az bicep decompile --file template.json
By using this, Azure CLI will take the input .json file and, after a few moments, will create a .bicep file under the same name with the .bicep extension.
Deciding upon choosing Bicep over ARM might become more difficult if you are looking to apply it to an already existing codebase where there has been significant usage of ARM already, and custom tooling has been configured in your project pipelines. Any integrations in use might also be a factor to consider here in case they are not compatible with Bicep files.
Build Secure Infrastructure as Code Using SecureFlag
Last year SecureFlag introduced labs for using Terraform, providing hands-on, interactive training in virtualized development environments. Now, SecureFlag offers in-depth labs for both Azure Bicep and ARM!
With the growing importance of IaC in development teams and the overall SDLC a unique learning approach is needed to stay up-to-date with processes and techniques. SecureFlag’s interactive labs expose developers to simulated attack scenarios, allowing them to understand vulnerabilities from an attacker’s perspective. With this knowledge, developers can look into how an attack occurs and how to precisely fix it.
SecureFlag’s Azure training labs empower you and your teams with practical, real-world scenarios, ensuring you’re equipped to confidently navigate the Azure ecosystem’s complexities.
In summary, the main differences and considerations between using these two Azure technologies come down to preference of style, syntax, and the already established processes in your projects. So, regardless of whether your team decides to use ARM or Bicep, your team should know how to secure IaC environments to the highest degree possible.
Contact us today to start your journey toward a more secure and collaborative software development environment.
