dotnet · IEvangelist · Apr 4, 2025 · Apr 3, 2025
diff --git a/docs/azureai/azureai-openai-integration.md b/docs/azureai/azureai-openai-integration.md
@@ -1,7 +1,7 @@
 ---
 title: .NET Aspire Azure OpenAI integration (Preview)
 description: Learn how to use the .NET Aspire Azure OpenAI integration.
-ms.date: 03/06/2025
+ms.date: 04/03/2025
 ---
 
 # .NET Aspire Azure OpenAI integration (Preview)
@@ -83,25 +83,9 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../snippets/azure/AppHost/openai.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Cognitive Services resource with the following defaults:
-
-- `location`: The location of the resource group.
-- `principalType`: The principal type of the Cognitive Services resource.
-- `principalId`: The principal ID of the Cognitive Services resource.
-- `openai`: The Cognitive Services account resource.
-  - `kind`: The kind of the resource, set to `OpenAI`.
-  - `properties`: The properties of the resource.
-    - `customSubDomainName`: The custom subdomain name for the resource, based on the unique string of the resource group ID.
-    - `publicNetworkAccess`: Set to `Enabled`.
-    - `disableLocalAuth`: Set to `true`.
-  - `sku`: The SKU of the resource, set to `S0`.
-- `openai_CognitiveServicesOpenAIContributor`: The Cognitive Services resource owner, based on the build-in `Azure Cognitive Services OpenAI Contributor` role. For more information, see [Azure Cognitive Services OpenAI Contributor](/azure/role-based-access-control/built-in-roles/ai-machine-learning#cognitive-services-openai-contributor).
-- `preview`: The deployment resource, based on the `preview` name.
-  - `properties`: The properties of the deployment resource.
-    - `format`: The format of the deployment resource, set to `OpenAI`.
-    - `modelName`: The model name of the deployment resource, set to `gpt-4.5-preview`.
-    - `modelVersion`: The model version of the deployment resource, set to `2025-02-27`.
-- `connectionString`: The connection string, containing the endpoint of the Cognitive Services resource.
+The preceding Bicep is a module that provisions an Azure Cognitive Services resource. Additionally, role assignments are created for the Azure resource in a separate module:
+
+:::code language="bicep" source="../snippets/azure/AppHost/openai-roles.module.bicep":::
 
 The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 

diff --git a/docs/azureai/azureai-search-document-integration.md b/docs/azureai/azureai-search-document-integration.md
@@ -1,7 +1,7 @@
 ---
 title: .NET Aspire Azure AI Search integration
 description: Learn how to integrate Azure AI Search with .NET Aspire.
-ms.date: 03/07/2025
+ms.date: 04/03/2025
 ---
 
 # .NET Aspire Azure AI Search integration
@@ -57,21 +57,9 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../snippets/azure/AppHost/search.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure AI Search service resource with the following defaults:
-
-- `location`: The location parameter of the resource group, defaults to `resourceGroup().location`.
-- `principalType`: The principal type parameter of the Azure AI Search resource.
-- `principalId`: The principal ID  parameter of the Azure AI Search resource.
-- `search`: The resource representing the Azure AI Search service.
-  - `properties`: The properties of the Azure AI Search service:
-    - `hostingMode`: Is set to `default`.
-    - `disableLocalAuth`: Is set to `true`.
-    - `partitionCount`: Is set to `1`.
-    - `replicaCount`: Is set to `1`.
-  - `sku`: Defaults to `basic`.
-- `search_SearchIndexDataContributor`: The role assignment for the Azure AI Search index data contributor role. For more information, see [Search Index Data Contributor](/azure/role-based-access-control/built-in-roles/ai-machine-learning#search-index-data-contributor).
-- `search_SearchServiceContributor`: The role assignment for the Azure AI Search service contributor role. For more information, see [Search Service Contributor](/azure/role-based-access-control/built-in-roles/ai-machine-learning#search-service-contributor).
-- `connectionString`: The connection string for the Azure AI Search service, which is used to connect to the service. The connection string is generated using the `Endpoint` property of the Azure AI Search service.
+The preceding Bicep is a module that provisions an Azure AI Search service resource. Additionally, role assignments are created for the Azure resource in a separate module:
+
+:::code language="bicep" source="../snippets/azure/AppHost/search-roles.module.bicep":::
 
 The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 

diff --git a/docs/caching/includes/azure-redis-app-host.md b/docs/caching/includes/azure-redis-app-host.md
@@ -50,19 +50,9 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../../snippets/azure/AppHost/redis.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Cache for Redis with the following defaults:
-
-- `location`: The location of the Azure Cache for Redis resource. The default is the location of the resource group.
-- `principalId`: The principal ID of the Azure Cache for Redis resource.
-- `principalName`: The principal name of the Azure Cache for Redis resource.
-- `sku`: The SKU of the Azure Cache for Redis resource. The default is `Basic` with a capacity of `1`.
-- `enableNonSslPort`: The non-SSL port of the Azure Cache for Redis resource. The default is `false`.
-- `disableAccessKeyAuthentication`: The access key authentication of the Azure Cache for Redis resource. The default is `true`.
-- `minimumTlsVersion`: The minimum TLS version of the Azure Cache for Redis resource. The default is `1.2`.
-- `redisConfiguration`: The Redis configuration of the Azure Cache for Redis resource. The default is `aad-enabled` set to `true`.
-- `tags`: The tags of the Azure Cache for Redis resource. The default is `aspire-resource-name` set to the name of the Aspire resource, in this case `redis`.
-- `redis_contributor`: The contributor of the Azure Cache for Redis resource, with an access policy name of `Data Contributor`.
-- `connectionString`: The connection string of the Azure Cache for Redis resource.
+The preceding Bicep is a module that provisions an Azure Cache for Redis resource. Additionally, role assignments are created for the Azure resource in a separate module:
+
+:::code language="bicep" source="../../snippets/azure/AppHost/redis-roles.module.bicep":::
 
 In addition to the Azure Cache for Redis, it also provisions an access policy assignment to the application access to the cache. The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 

diff --git a/docs/database/includes/cosmos-app-host.md b/docs/database/includes/cosmos-app-host.md
@@ -49,13 +49,11 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../../snippets/azure/AppHost/cosmos.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Cosmos DB account with the following defaults:
+The preceding Bicep is a module that provisions an Azure Cosmos DB account resource. Additionally, role assignments are created for the Azure resource in a separate module:
 
-- `kind`: The kind of Cosmos DB account. The default is `GlobalDocumentDB`.
-- `consistencyPolicy`: The consistency policy of the Cosmos DB account. The default is `Session`.
-- `locations`: The locations for the Cosmos DB account. The default is the resource group's location.
+:::code language="bicep" source="../../snippets/azure/AppHost/cosmos-roles.module.bicep":::
 
-In addition to the Cosmos DB account, it also adds the current application to the `Data Contributor` role for the Cosmos DB account. The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
+The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 
 #### Customize provisioning infrastructure
 

diff --git a/docs/database/includes/postgresql-flexible-server.md b/docs/database/includes/postgresql-flexible-server.md
@@ -62,16 +62,9 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../../snippets/azure/AppHost/postgres-flexible.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure PostgreSQL flexible server with the following defaults:
-
-- `authConfig`: The authentication configuration of the PostgreSQL server. The default is `ActiveDirectoryAuth` enabled and `PasswordAuth` disabled.
-- `availabilityZone`: The availability zone of the PostgreSQL server. The default is `1`.
-- `backup`: The backup configuration of the PostgreSQL server. The default is `BackupRetentionDays` set to `7` and `GeoRedundantBackup` set to `Disabled`.
-- `highAvailability`: The high availability configuration of the PostgreSQL server. The default is `Disabled`.
-- `storage`: The storage configuration of the PostgreSQL server. The default is `StorageSizeGB` set to `32`.
-- `version`: The version of the PostgreSQL server. The default is `16`.
-- `sku`: The SKU of the PostgreSQL server. The default is `Standard_B1ms`.
-- `tags`: The tags of the PostgreSQL server. The default is `aspire-resource-name` set to the name of the Aspire resource, in this case `postgres-flexible`.
+The preceding Bicep is a module that provisions an Azure PostgreSQL flexible server resource. Additionally, role assignments are created for the Azure resource in a separate module:
+
+:::code language="bicep" source="../../snippets/azure/AppHost/postgres-flexible-roles.module.bicep":::
 
 In addition to the PostgreSQL flexible server, it also provisions an Azure Firewall rule to allow all Azure IP addresses. Finally, an administrator is created for the PostgreSQL server, and the connection string is outputted as an output variable. The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 

diff --git a/docs/messaging/azure-event-hubs-integration.md b/docs/messaging/azure-event-hubs-integration.md
@@ -1,7 +1,7 @@
 ---
 title: .NET Aspire Azure Event Hubs integration
 description: This article describes the .NET Aspire Azure Event Hubs integration features and capabilities.
-ms.date: 03/10/2025
+ms.date: 04/03/2025
 ---
 
 # .NET Aspire Azure Event Hubs integration
@@ -65,16 +65,9 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../snippets/azure/AppHost/event-hubs.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Event Hubs resource with the following defaults:
+The preceding Bicep is a module that provisions an Azure Event Hubs resource. Additionally, role assignments are created for the Azure resource in a separate module:
 
-- `location`: The location of the resource group.
-- `sku`: The SKU of the Event Hubs resource, defaults to `Standard`.
-- `principalId`: The principal ID of the Event Hubs resource.
-- `principalType`: The principal type of the Event Hubs resource.
-- `event_hubs`: The Event Hubs namespace resource.
-- `event_hubs_AzureEventHubsDataOwner`: The Event Hubs resource owner, based on the build-in `Azure Event Hubs Data Owner` role. For more information, see [Azure Event Hubs Data Owner](/azure/role-based-access-control/built-in-roles/analytics#azure-event-hubs-data-owner).
-- `messages`: The Event Hub resource.
-- `eventHubsEndpoint`: The endpoint of the Event Hubs resource.
+:::code language="bicep" source="../snippets/azure/AppHost/event-hubs-roles.module.bicep":::
 
 The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 

diff --git a/docs/messaging/azure-service-bus-integration.md b/docs/messaging/azure-service-bus-integration.md
@@ -59,10 +59,9 @@ If you're new to Bicep, it's a domain-specific language for defining Azure resou
 
 :::code language="bicep" source="../snippets/azure/AppHost/service-bus.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Service Bus namespace with the following defaults:
+The preceding Bicep is a module that provisions an Azure Service Bus namespace resource. Additionally, role assignments are created for the Azure resource in a separate module:
 
-- `sku`: The SKU of the Service Bus namespace. The default is Standard.
-- `location`: The location for the Service Bus namespace. The default is the resource group's location.
+:::code language="bicep" source="../snippets/azure/AppHost/service-bus-roles.module.bicep":::
 
 In addition to the Service Bus namespace, it also provisions an Azure role-based access control (Azure RBAC) built-in role of Azure Service Bus Data Owner. The role is assigned to the Service Bus namespace's resource group. For more information, see [Azure Service Bus Data Owner](/azure/role-based-access-control/built-in-roles/integration#azure-service-bus-data-owner).
 

diff --git a/docs/messaging/azure-web-pubsub-integration.md b/docs/messaging/azure-web-pubsub-integration.md
@@ -2,7 +2,7 @@
 title: .NET Aspire Azure Web PubSub integration
 description: This article describes the .NET Aspire Azure Web PubSub integration features and capabilities.
 ms.topic: how-to
-ms.date: 03/17/2025
+ms.date: 04/03/2025
 ---
 
 # .NET Aspire Azure Web PubSub integration
@@ -101,17 +101,9 @@ When you add an Azure Web PubSub resource, the following Bicep is generated:
 
 :::code language="bicep" source="../snippets/azure/AppHost/web-pubsub.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Web PubSub resource with the following defaults:
-
-- `location`: The location of the resource group.
-- `sku`: The SKU of the Web PubSub resource, defaults to `Free_F1`.
-- `principalId`: The principal ID of the Web PubSub resource.
-- `principalType`: The principal type of the Web PubSub resource.
-- `messages_url_0`: The URL of the event handler for the `messages` hub.
-- `messages`: The name of the hub resource.
-- `web_pubsub`: The name of the Web PubSub resource.
-- `web_pubsub_WebPubSubServiceOwner`: The role assignment for the Web PubSub resource owner. For more information, see [Azure Web PubSub Service Owner](/azure/role-based-access-control/built-in-roles/web-and-mobile#web-pubsub-service-owner).
-- `endpoint`: The endpoint of the Web PubSub resource.
+The preceding Bicep is a module that provisions an Azure Web PubSub resource. Additionally, role assignments are created for the Azure resource in a separate module:
+
+:::code language="bicep" source="../snippets/azure/AppHost/web-pubsub-roles.module.bicep":::
 
 The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.
 

diff --git a/docs/security/azure-security-key-vault-integration.md b/docs/security/azure-security-key-vault-integration.md
@@ -61,28 +61,9 @@ If you're new to [Bicep](/azure/azure-resource-manager/bicep/overview), it's a d
 
 :::code language="bicep" source="../snippets/azure/AppHost/key-vault.module.bicep":::
 
-The preceding Bicep is a module that provisions an Azure Key Vault resource with the following defaults:
-
-- `location`: The location of the resource group.
-- `principalId`: The principal ID of the user or service principal.
-- `principalType`: The principal type of the user or service principal.
-- `key_vault`: The Azure Key Vault resource:
-  - `name`: A unique name for the Azure Key Vault.
-  - `properties`: The Azure Key Vault properties:
-    - `tenantId`: The tenant ID of the Azure Key Vault.
-    - `sku`: The Azure Key Vault SKU:
-      - `family`: The SKU family.
-      - `name`: The SKU name.
-    - `enableRbacAuthorization`: A boolean value that indicates whether the Azure Key Vault has role-based access control (RBAC) authorization enabled.
-  - `tags`: The Azure Key Vault tags.
-- `key_vault_KeyVaultAdministrator`: The Azure Key Vault administrator role assignment:
-  - `name`: A unique name for the role assignment.
-  - `properties`: The role assignment properties:
-    - `principalId`: The principal ID of the user or service principal.
-    - `roleDefinitionId`: The role definition ID of the Azure Key Vault administrator role.
-    - `principalType`: The principal type of the user or service principal.
-  - `scope`: The scope of the role assignment.
-- `output`: The Azure Key Vault URI.
+The preceding Bicep is a module that provisions an Azure Key Vault resource. Additionally, role assignments are created for the Azure resource in a separate module:
+
+:::code language="bicep" source="../snippets/azure/AppHost/key-vault-roles.module.bicep":::
 
 The generated Bicep is a starting point and is influenced by changes to the provisioning infrastructure in C#. Customizations to the Bicep file directly will be overwritten, so make changes through the C# provisioning APIs to ensure they are reflected in the generated files.