> **Important:** This skill provides guidance and recommended instructions to assist the AI system. Outputs are not guaranteed to be complete, correct, secure, or applicable to every scenario. Results should be reviewed and validated by a human before being applied. The AI model may choose not to follow all instructions exactly, and additional verification may be required. # Bicep — Static Web Apps Patterns SWA-specific Bicep patterns. For shared patterns (skeleton, naming, tags, security defaults, data modules), see [bicep-patterns.md](bicep-patterns.md). ## Module Template SWA modules for token-based deploys (no GitHub CI/CD): ```bicep resource staticWebApp 'Microsoft.Web/staticSites@2023-12-01' = { name: swaName location: location tags: tags sku: { name: 'Standard', tier: 'Standard' } properties: {} // ⛔ MUST be empty — no repositoryUrl, no branch, no buildProperties } ``` > ⛔ **Standard SKU minimum — Free SWA is not offered.** Free Static Web Apps lack the configuration these apps need (custom authentication, configurable CORS, SLA, private endpoints, BYO API backends via managed identity). Always emit `sku: { name: 'Standard', tier: 'Standard' }`. > ⛔ **The API must allow this SWA's origin.** A SWA calling a Function App or App Service is cross-origin, so > the **backend** needs `siteConfig.cors.allowedOrigins` containing `https://${staticWebApp.properties.defaultHostname}`. > Nothing on the SWA resource itself fixes this. Omitting it deploys cleanly and then fails every browser > call with `No 'Access-Control-Allow-Origin' header is present`. See > [bicep-patterns.md § Cross-Origin (CORS)](bicep-patterns.md). > ⛔ **Detached SWA deploy:** Omit `repositoryUrl`, `branch`, and `buildProperties` entirely. These are only for GitHub Actions–connected deployments. Including `repositoryUrl: ''` causes `BadRequest: RepositoryUrl is invalid`.