Best Way to hadnel "shared" resources with deployment stacks?

[h00jraq]

Hi,

I have a situation where I want to run few app services with staging slots on same app service plan for Dev/Test/Stage and having separate App Service Plan for Production.
What I'm trying to figure out is to how to handle deployment of that single App Service Plan for those 4 environments.
Basically, all the resources exist Per Environment but the App Service Plan is shared.

I did not want to create separate deployment stack just for that ASP but maybe this is the correct way?
My current idea is to use something like below but I'm just not sure if this is the correct way.

@allowed([
  'new'
  'existing'
])
param newOrExisting string
param hostingPlanWindowsName 


resource hostingPlanWindows 'Microsoft.Web/serverfarms@2022-09-01' =  if (newOrExisting == 'new') {
  name: hostingPlanWindowsName
  location: location
  sku: {
    name: 'P1V3'
    tier: 'PremiumV3'
  }
  properties: {}
} 

resource existingHostingPlanWindows 'Microsoft.Web/serverfarms@2022-09-01' existing = if (newOrExisting == 'existing') {
  name: hostingPlanWindowsName
}

and then, when deploying the App service:

resource webApp 'Microsoft.Web/sites@2022-09-01' = {
  name: webAppNameReferralAPIMngmt
  location: location
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${userAssignedIdentity.id}': {}
    }
  }
  properties: {
    serverFarmId: ((newOrExisting == 'new') ? hostingPlanWindows.id : existingHostingPlanWindows.id)
 

Parameter hostingPlanWindowsName will be set to the same variable for Dev/Test/Stage so for Dev environment, newOrExisting will be set to new but for Test and Stage it will be set to existing so no new ASP should be deployed.

The only things that worries me here is that I'm not sure if this is good approach as from what I understand, by using above code, this single ASP will belong all 3 deployment stacks or at least I think it will. Please correct me if I'm wrong.

For sure, I don't want this to be deleted so I could add a resource lock but I still wanna other resources to be deleted
so I thought I will stick to using --delete-resources setting.

Would you handle this differently and add separate step for deploying just this app service plan and having separate bicep file for it and keeping it in separate deployment stack?

[ahelland]

Well, there's certainly different ways to skin this cat.

I would probably create different plans for the different environments, but I already split the the environments across different subscriptions. (Enterprise Landing Zone, hub & spoke, etc. and for "cheap" resources cost is less of a concern.) But there are of course different options for your Azure architecture.

If I were to use one plan for separate environments/sites I would still split deployment of the plan and the sites and have these as different stacks. A stack doesn't have a cost so as long as you structure things logically it's clearer that way. Once again borrowing from CAF and thinking in layers the two resources fit on different levels and I want to adjust them accordingly.

But that's just my two cents :)

[h00jraq]

Well I would certainly do that (use different plan for different environments) but... I don't want to do that because of the cost. Yea, it is quite cheap for some but in my case, this single plan is enough when it comes to performance.

Ultimately, I believe I will have to do that - have single plan for single env as this is just easier to handle with both bicep code and other pipelines.