---
description: Manage Azure infrastructure with Bicep templates — provision, update, and monitor cloud resources
argument-hint: [up|down|plan|status]
allowed-tools: Read, Write, Edit, Bash, Glob, AskUserQuestion
---

# /morph-infra - Infrastructure Management

Manage Azure infrastructure using Bicep templates.

## Usage

```
/morph-infra [action] [options]
```

### Actions

| Action | Description |
|--------|-------------|
| `init` | Initialize IaC structure in the project |
| `validate` | Validate Bicep templates |
| `plan` | Show what-if of changes |
| `deploy` | Execute resource deployment |
| `destroy` | Remove all resources |

---

## Workflow

### 1. INIT - Initialize IaC

When the user requests `/morph-infra init`:

1. Create the `infra/` structure in the project:
   ```
   infra/
   ├── main.bicep
   ├── parameters.dev.json
   ├── parameters.prod.json
   └── modules/
       ├── container-app.bicep
       ├── container-app-env.bicep
       ├── sql-database.bicep
       ├── storage.bicep
       ├── key-vault.bicep
       └── app-insights.bicep
   ```

2. Copy templates from `.morph/framework/templates/infrastructure/...`

3. Replace placeholders:
   - `{{APP_NAME}}` → project name
   - `{{SUBSCRIPTION_ID}}` → request from user
   - `{{RESOURCE_GROUP}}` → suggest default `rg-{app}-{env}`

4. Document the created structure in `decisions.md`

---

### 2. VALIDATE - Validate Templates

When the user requests `/morph-infra validate`:

1. Run Bicep validation:
   ```bash
   az bicep build --file infra/main.bicep
   ```

2. Check required parameters

3. Report errors or success

---

### 3. PLAN - Preview Changes

When the user requests `/morph-infra plan [env]`:

1. Check if Azure CLI is authenticated:
   ```bash
   az account show
   ```

2. Run what-if:
   ```bash
   az deployment group what-if \
     --resource-group rg-{app}-{env} \
     --template-file infra/main.bicep \
     --parameters @infra/parameters.{env}.json
   ```

3. Present change summary:
   - Resources to create
   - Resources to modify
   - Resources to delete
   - Estimated costs

4. **STOP and wait for approval** before deploy

---

### 4. DEPLOY - Execute Deploy

When the user requests `/morph-infra deploy [env]`:

1. Verify plan was approved

2. Create resource group if it doesn't exist:
   ```bash
   az group create --name rg-{app}-{env} --location brazilsouth
   ```

3. Execute deploy:
   ```bash
   az deployment group create \
     --resource-group rg-{app}-{env} \
     --template-file infra/main.bicep \
     --parameters @infra/parameters.{env}.json
   ```

4. Capture outputs:
   - Container App URL
   - SQL Connection String
   - Key Vault URI

5. Update documentation with deploy information

---

### 5. DESTROY - Remove Resources

When the user requests `/morph-infra destroy [env]`:

1. **WARN** that this action is irreversible

2. List resources that will be deleted

3. **STOP and wait for explicit confirmation** ("yes, delete")

4. Execute:
   ```bash
   az group delete --name rg-{app}-{env} --yes --no-wait
   ```

---

## Security Rules

### NEVER:
- Expose secrets in logs
- Commit files with secrets
- Delete production resources without explicit confirmation
- Create resources outside Bicep (zero portal)

### ALWAYS:
- Use Key Vault for secrets
- Validate Bicep before deploy
- Run what-if before deploy
- Document estimated costs
- Keep parameters.json separated by environment

---

## Cost Guardian Integration

Before any deploy, check with Cost Guardian:

1. Estimate monthly resource costs
2. Verify it's within approved limits:
   - Free tier: no approval needed
   - Up to $10/month: requires confirmation
   - Above $10: requires ADR

---

## Usage Example

```
User: /morph-infra init
Claude: Creating IaC structure...
        - infra/main.bicep
        - infra/parameters.dev.json
        - infra/modules/*.bicep
        Done! Run /morph-infra validate to verify.

User: /morph-infra plan dev
Claude: Analyzing changes for dev environment...

        CREATE:
        + Container App Environment
        + Container App
        + SQL Server (Free)
        + Storage Account (LRS)
        + Key Vault
        + Application Insights

        ESTIMATED COST: ~$0/month (Free tier)

        Approve deploy? (yes/no)

User: yes
Claude: Executing deploy...
        ✓ Resource Group created
        ✓ Deploy completed in 3m 45s

        OUTPUTS:
        - URL: https://myapp-dev.azurecontainerapps.io
        - SQL: tcp:myapp-dev-sql.database.windows.net
        - Key Vault: https://myapp-dev-kv.vault.azure.net
```

---

*MORPH-SPEC by Polymorphism Tech*