/azure-enterprise-infra-planner

Phase 6: Generate IaC

Important: Before continuing this phase, meta.status must be set to approved as required by Phase 5.

1. Ask the user whether to generate Bicep or Terraform.
2. Generate IaC from the approved plan. Refer to bicep-generation.md for Bicep or terraform-generation.md for Terraform.
3. Apply secure-by-default (mandatory). Unless the approved plan explicitly overrides a control, every generated resource must use:
   • Private endpoints and publicNetworkAccess: Disabled on data/PaaS services — no unnecessary public exposure.
   • Managed identity + RBAC instead of keys/connection strings; no secrets in code (@secure() / sensitive = true).
   • Storage allowSharedKeyAccess: false; Key Vault soft-delete + purge protection; AKS managed identity with local accounts disabled.
   • Minimum TLS 1.2 and encryption in transit.
4. Validate, security-scan, and fix until clean (mandatory, self-verifying). No-deploy, purely local:
   • Bicep: run az bicep build --file infra/main.bicep.
   • Terraform: run terraform init -backend=false then terraform validate in infra/.
   • Security scan: run checkov -d infra/ and resolve every high/critical finding.
   • If any command reports errors or unresolved high/critical findings, fix the files in-place and re-run. Repeat until every command exits cleanly.
   • Prove it: paste the exact command(s) run and their final exit status / summary into your response. Do not claim the gate passed without showing the output. If a tool is genuinely unavailable, say so explicitly and self-review against the generation correctness checklist and the secure-by-default list above.
5. Emit the completion self-check. End Phase 6 with this checklist, each line marked pass/fail with a one-line reason:
   • Validation ran and exited clean (output shown)
   • checkov ran; no unresolved high/critical findings
   • Secure-by-default applied (private endpoints, MI/RBAC, TLS 1.2, no secrets)
   • Referenced resources wired, none recreated (referenced mode only)
   • Files under infra/; original source artifacts untouched

Gate

• All required IaC files generated and saved to disk under <project-root>/infra/.
• az bicep build (Bicep) or terraform validate (Terraform) and checkov complete with zero errors and no unresolved high/critical findings, with the command output shown in the response.
• The completion self-check is emitted with every item passing (or an explicit, justified exception).