Skip to content

Commit 9d5cf55

Browse files
dharakumarmsftdharakumarmsft
authored
Add support azure functions (#252)
* Add azure function tool support * Add azure function tool support
1 parent e609b75 commit 9d5cf55

File tree

5 files changed

+244
-29
lines changed

5 files changed

+244
-29
lines changed

‎scenarios/Agents/setup/network-secured-agent-thread-storage/README.md‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ languages:
2121
![Best Practice Check](https://azurequickstartsservice.blob.core.windows.net/badges/quickstarts/microsoft.azure-ai-agent-service/network-secured-agent/BestPracticeResult.svg)
2222
![Cred Scan Check](https://azurequickstartsservice.blob.core.windows.net/badges/quickstarts/microsoft.azure-ai-agent-service/network-secured-agent/CredScanResult.svg)
2323

24-
![Bicep Version](https://azurequickstartsservice.blob.core.windows.net/badges/quickstarts/microsoft.azure-ai-agent-service/network-secured-agent-thread/BicepVersion.svg)
24+
![Bicep Version](https://azurequickstartsservice.blob.core.windows.net/badges/quickstarts/microsoft.azure-ai-agent-service/basic-agent-keys/BicepVersion.svg)
2525

2626
[![Deploy To Azure](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazure.svg?sanitize=true)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2Fazureai-samples%2Fmain%2Fscenarios%2FAgents%2Fsetup%2Fnetwork-secured-agent-thread-storage%2Fazuredeploy.json)
2727

@@ -57,7 +57,10 @@ To find your discovery_url, run the CLI command:
5757
```az ml workspace show -n {project_name} --resource-group {resource_group_name} --query discovery_url```
5858
Customer needs to login to Azure subscription via Azure CLI and set the environment variables
5959

60-
60+
In case Azure Funtion Tool required, select from dropdown or edit in bicep
61+
```
62+
azureFunctionToolSupport=Enabled
63+
```
6164
## Architecture Overview
6265

6366
### Network Security Design
@@ -72,12 +75,14 @@ The deployment creates an isolated network environment:
7275
- AI Services
7376
- AI Search
7477
- Key Vault
75-
- Storage Account
78+
- Storage Account Blob
79+
- Storage Account Queue(Only created for Azure Function tool)
7680
- Cosmos DB
7781

7882
- **Private DNS Zones**
7983
- privatelink.azureml.ms
8084
- privatelink.search.windows.net
85+
- privatelonk.queue.core.windows.net
8186
- privatelink.blob.core.windows.net
8287
- privatelink.documents.azure.com
8388

@@ -97,7 +102,8 @@ The deployment creates an isolated network environment:
97102
- Azure AI Services
98103
- Azure AI Search
99104
- Key Vault
100-
- Storage Account
105+
- Storage Account Blob
106+
- Storage Account Queue(Only created for Azure Function tool)
101107
- Cosmos DB Account
102108

103109
## Security Features

‎scenarios/Agents/setup/network-secured-agent-thread-storage/azuredeploy.json‎

Lines changed: 132 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.33.93.31351",
8-
"templateHash": "11033492472783042104"
8+
"templateHash": "6189989562818270199"
99
}
1010
},
1111
"parameters": {
@@ -227,6 +227,17 @@
227227
"description": "The Cosmos DB Account full ARM Resource ID. This is an optional field, and if not provided, the resource will be created."
228228
}
229229
},
230+
"azureFunctionToolSupport": {
231+
"type": "string",
232+
"defaultValue": "Disabled",
233+
"allowedValues": [
234+
"Enabled",
235+
"Disabled"
236+
],
237+
"metadata": {
238+
"description": "Specifies if supporting resources for the Azure Function Tools should be created. This is only required if you are using the Azure Function Tools."
239+
}
240+
},
230241
"userAssignedIdentityDefaultName": {
231242
"type": "string",
232243
"defaultValue": "[format('secured-agents-identity-{0}', parameters('uniqueSuffix'))]",
@@ -248,7 +259,8 @@
248259
"cosmosParts": "[split(parameters('cosmosDBResourceId'), '/')]",
249260
"cosmosDBSubscriptionId": "[if(variables('cosmosExists'), variables('cosmosParts')[2], subscription().subscriptionId)]",
250261
"cosmosDBResourceGroupName": "[if(variables('cosmosExists'), variables('cosmosParts')[4], resourceGroup().name)]",
251-
"cosmosDBAccountName": "[if(variables('cosmosExists'), variables('cosmosParts')[8], variables('cosmosDBName'))]"
262+
"cosmosDBAccountName": "[if(variables('cosmosExists'), variables('cosmosParts')[8], variables('cosmosDBName'))]",
263+
"azureFunctionToolSupported": "[equals(parameters('azureFunctionToolSupport'), 'Enabled')]"
252264
},
253265
"resources": [
254266
{
@@ -525,6 +537,9 @@
525537
"cosmosDBExists": {
526538
"value": "[not(empty(parameters('cosmosDBResourceId')))]"
527539
},
540+
"azureFunctionToolSupported": {
541+
"value": "[variables('azureFunctionToolSupported')]"
542+
},
528543
"cosmosDBName": {
529544
"value": "[variables('cosmosDBAccountName')]"
530545
},
@@ -563,7 +578,7 @@
563578
"_generator": {
564579
"name": "bicep",
565580
"version": "0.33.93.31351",
566-
"templateHash": "13503356786023840518"
581+
"templateHash": "12245658005145867857"
567582
}
568583
},
569584
"parameters": {
@@ -587,6 +602,10 @@
587602
"type": "bool",
588603
"defaultValue": false
589604
},
605+
"azureFunctionToolSupported": {
606+
"type": "bool",
607+
"defaultValue": false
608+
},
590609
"location": {
591610
"type": "string",
592611
"defaultValue": "[resourceGroup().location]",
@@ -716,6 +735,33 @@
716735
"storageParts": "[if(parameters('storageExists'), split(resourceId('Microsoft.Storage/storageAccounts', parameters('storageName')), '/'), split(resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleaned')), '/'))]"
717736
},
718737
"resources": [
738+
{
739+
"condition": "[and(not(parameters('storageExists')), parameters('azureFunctionToolSupported'))]",
740+
"type": "Microsoft.Storage/storageAccounts/queueServices/queues",
741+
"apiVersion": "2022-05-01",
742+
"name": "[format('{0}/{1}/{2}', variables('storageNameCleaned'), 'default', 'input-queue')]",
743+
"dependsOn": [
744+
"[resourceId('Microsoft.Storage/storageAccounts/queueServices', variables('storageNameCleaned'), 'default')]"
745+
]
746+
},
747+
{
748+
"condition": "[and(not(parameters('storageExists')), parameters('azureFunctionToolSupported'))]",
749+
"type": "Microsoft.Storage/storageAccounts/queueServices/queues",
750+
"apiVersion": "2022-05-01",
751+
"name": "[format('{0}/{1}/{2}', variables('storageNameCleaned'), 'default', 'output-queue')]",
752+
"dependsOn": [
753+
"[resourceId('Microsoft.Storage/storageAccounts/queueServices', variables('storageNameCleaned'), 'default')]"
754+
]
755+
},
756+
{
757+
"condition": "[and(not(parameters('storageExists')), parameters('azureFunctionToolSupported'))]",
758+
"type": "Microsoft.Storage/storageAccounts/queueServices",
759+
"apiVersion": "2022-05-01",
760+
"name": "[format('{0}/{1}', variables('storageNameCleaned'), 'default')]",
761+
"dependsOn": [
762+
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleaned'))]"
763+
]
764+
},
719765
{
720766
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
721767
"apiVersion": "2023-07-31-preview",
@@ -1480,6 +1526,9 @@
14801526
},
14811527
"cosmosDBResourceGroup": {
14821528
"value": "[variables('cosmosDBResourceGroupName')]"
1529+
},
1530+
"azureFunctionToolSupported": {
1531+
"value": "[variables('azureFunctionToolSupported')]"
14831532
}
14841533
},
14851534
"template": {
@@ -1489,7 +1538,7 @@
14891538
"_generator": {
14901539
"name": "bicep",
14911540
"version": "0.33.93.31351",
1492-
"templateHash": "2815470915491127245"
1541+
"templateHash": "1489959358682641210"
14931542
}
14941543
},
14951544
"parameters": {
@@ -1561,6 +1610,13 @@
15611610
"metadata": {
15621611
"description": "Name of the Customer Hub Workspace"
15631612
}
1613+
},
1614+
"azureFunctionToolSupported": {
1615+
"type": "bool",
1616+
"defaultValue": false,
1617+
"metadata": {
1618+
"description": "Flag indicating whether azure function tools are supported and backing resources need to be created."
1619+
}
15641620
}
15651621
},
15661622
"resources": [
@@ -1633,15 +1689,15 @@
16331689
{
16341690
"type": "Microsoft.Network/privateEndpoints",
16351691
"apiVersion": "2024-05-01",
1636-
"name": "[format('{0}-private-endpoint', parameters('storageName'))]",
1692+
"name": "[format('{0}-blob-private-endpoint', parameters('storageName'))]",
16371693
"location": "[resourceGroup().location]",
16381694
"properties": {
16391695
"subnet": {
16401696
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('cxSubnetName'))]"
16411697
},
16421698
"privateLinkServiceConnections": [
16431699
{
1644-
"name": "[format('{0}-private-link-service-connection', parameters('storageName'))]",
1700+
"name": "[format('{0}-blob-private-link-service-connection', parameters('storageName'))]",
16451701
"properties": {
16461702
"privateLinkServiceId": "[parameters('aiStorageId')]",
16471703
"groupIds": [
@@ -1652,6 +1708,29 @@
16521708
]
16531709
}
16541710
},
1711+
{
1712+
"condition": "[parameters('azureFunctionToolSupported')]",
1713+
"type": "Microsoft.Network/privateEndpoints",
1714+
"apiVersion": "2024-05-01",
1715+
"name": "[format('{0}-queue-private-endpoint', parameters('storageName'))]",
1716+
"location": "[resourceGroup().location]",
1717+
"properties": {
1718+
"subnet": {
1719+
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('cxSubnetName'))]"
1720+
},
1721+
"privateLinkServiceConnections": [
1722+
{
1723+
"name": "[format('{0}-queue-private-link-service-connection', parameters('storageName'))]",
1724+
"properties": {
1725+
"privateLinkServiceId": "[parameters('aiStorageId')]",
1726+
"groupIds": [
1727+
"queue"
1728+
]
1729+
}
1730+
}
1731+
]
1732+
}
1733+
},
16551734
{
16561735
"type": "Microsoft.Network/privateEndpoints",
16571736
"apiVersion": "2024-05-01",
@@ -1894,10 +1973,17 @@
18941973
"name": "[format('privatelink.blob.{0}', environment().suffixes.storage)]",
18951974
"location": "global"
18961975
},
1976+
{
1977+
"condition": "[parameters('azureFunctionToolSupported')]",
1978+
"type": "Microsoft.Network/privateDnsZones",
1979+
"apiVersion": "2020-06-01",
1980+
"name": "[format('privatelink.queue.{0}', environment().suffixes.storage)]",
1981+
"location": "global"
1982+
},
18971983
{
18981984
"type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
18991985
"apiVersion": "2024-06-01",
1900-
"name": "[format('{0}/{1}', format('privatelink.blob.{0}', environment().suffixes.storage), format('storage-{0}-link', parameters('suffix')))]",
1986+
"name": "[format('{0}/{1}', format('privatelink.blob.{0}', environment().suffixes.storage), format('storage-blob-{0}-link', parameters('suffix')))]",
19011987
"location": "global",
19021988
"properties": {
19031989
"virtualNetwork": {
@@ -1909,14 +1995,30 @@
19091995
"[resourceId('Microsoft.Network/privateDnsZones', format('privatelink.blob.{0}', environment().suffixes.storage))]"
19101996
]
19111997
},
1998+
{
1999+
"condition": "[parameters('azureFunctionToolSupported')]",
2000+
"type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
2001+
"apiVersion": "2024-06-01",
2002+
"name": "[format('{0}/{1}', format('privatelink.queue.{0}', environment().suffixes.storage), format('storage-queue-{0}-link', parameters('suffix')))]",
2003+
"location": "global",
2004+
"properties": {
2005+
"virtualNetwork": {
2006+
"id": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]"
2007+
},
2008+
"registrationEnabled": false
2009+
},
2010+
"dependsOn": [
2011+
"[resourceId('Microsoft.Network/privateDnsZones', format('privatelink.queue.{0}', environment().suffixes.storage))]"
2012+
]
2013+
},
19122014
{
19132015
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
19142016
"apiVersion": "2024-05-01",
1915-
"name": "[format('{0}/{1}', format('{0}-private-endpoint', parameters('storageName')), format('{0}-dns-group', parameters('storageName')))]",
2017+
"name": "[format('{0}/{1}', format('{0}-blob-private-endpoint', parameters('storageName')), format('{0}-blob-dns-group', parameters('storageName')))]",
19162018
"properties": {
19172019
"privateDnsZoneConfigs": [
19182020
{
1919-
"name": "[format('{0}-dns-config', parameters('storageName'))]",
2021+
"name": "[format('{0}-blob-dns-config', parameters('storageName'))]",
19202022
"properties": {
19212023
"privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', format('privatelink.blob.{0}', environment().suffixes.storage))]"
19222024
}
@@ -1925,7 +2027,27 @@
19252027
},
19262028
"dependsOn": [
19272029
"[resourceId('Microsoft.Network/privateDnsZones', format('privatelink.blob.{0}', environment().suffixes.storage))]",
1928-
"[resourceId('Microsoft.Network/privateEndpoints', format('{0}-private-endpoint', parameters('storageName')))]"
2030+
"[resourceId('Microsoft.Network/privateEndpoints', format('{0}-blob-private-endpoint', parameters('storageName')))]"
2031+
]
2032+
},
2033+
{
2034+
"condition": "[parameters('azureFunctionToolSupported')]",
2035+
"type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
2036+
"apiVersion": "2024-05-01",
2037+
"name": "[format('{0}/{1}', format('{0}-queue-private-endpoint', parameters('storageName')), format('{0}-queue-dns-group', parameters('storageName')))]",
2038+
"properties": {
2039+
"privateDnsZoneConfigs": [
2040+
{
2041+
"name": "[format('{0}-queue-dns-config', parameters('storageName'))]",
2042+
"properties": {
2043+
"privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', format('privatelink.queue.{0}', environment().suffixes.storage))]"
2044+
}
2045+
}
2046+
]
2047+
},
2048+
"dependsOn": [
2049+
"[resourceId('Microsoft.Network/privateDnsZones', format('privatelink.queue.{0}', environment().suffixes.storage))]",
2050+
"[resourceId('Microsoft.Network/privateEndpoints', format('{0}-queue-private-endpoint', parameters('storageName')))]"
19292051
]
19302052
},
19312053
{

‎scenarios/Agents/setup/network-secured-agent-thread-storage/main.bicep‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,12 @@ param aiSearchServiceName string = ''
138138
@description('The Cosmos DB Account full ARM Resource ID. This is an optional field, and if not provided, the resource will be created.')
139139
param cosmosDBResourceId string = ''
140140

141+
@description('Specifies if supporting resources for the Azure Function Tools should be created. This is only required if you are using the Azure Function Tools.')
142+
@allowed([
143+
'Enabled'
144+
'Disabled'
145+
])
146+
param azureFunctionToolSupport string = 'Disabled'
141147

142148
// @description('The Ai Storage Account name. This is an optional field, and if not provided, the resource will be created.The resource should exist in same resource group')
143149
// param aiStorageAccountName string = ''
@@ -173,6 +179,8 @@ var cosmosParts = split(cosmosDBResourceId, '/')
173179
var cosmosDBSubscriptionId = cosmosExists ? cosmosParts[2] : subscription().subscriptionId
174180
var cosmosDBResourceGroupName = cosmosExists ? cosmosParts[4] : resourceGroup().name
175181
var cosmosDBAccountName = cosmosExists ? cosmosParts[8] : cosmosDBName
182+
var azureFunctionToolSupported = (azureFunctionToolSupport == 'Enabled')
183+
176184
// Create Virtual Network and Subnets
177185
module vnet 'modules-network-secured/networking/vnet.bicep' = {
178186
name: '${name}-${uniqueSuffix}--vnet'
@@ -203,6 +211,7 @@ module aiDependencies 'modules-network-secured/network-secured-dependent-resourc
203211
aiServicesExists: !empty(aiServiceAccountName)
204212
aiSearchExists: !empty(aiSearchServiceName)
205213
cosmosDBExists: !empty(cosmosDBResourceId)
214+
azureFunctionToolSupported: azureFunctionToolSupported
206215
cosmosDBName: cosmosDBAccountName
207216
cosmosDBSubscription: cosmosDBSubscriptionId
208217
cosmosDBResourceGroup: cosmosDBResourceGroupName
@@ -294,6 +303,7 @@ module privateEndpointAndDNS 'modules-network-secured/private-endpoint-and-dns.b
294303
cosmosDBName: aiDependencies.outputs.cosmosDBName // Cosmos DB name
295304
cosmosDBSubscription: cosmosDBSubscriptionId // Cosmos DB subscription ID
296305
cosmosDBResourceGroup: cosmosDBResourceGroupName // Cosmos DB resource group name
306+
azureFunctionToolSupported: azureFunctionToolSupported // Flag for Azure Function Tools support
297307
}
298308
dependsOn: [
299309
aiServices // Ensure AI Services exist

‎scenarios/Agents/setup/network-secured-agent-thread-storage/modules-network-secured/network-secured-dependent-resources.bicep‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ param keyvaultExists bool = false
2424
param aiServicesExists bool = false
2525
param aiSearchExists bool = false
2626
param cosmosDBExists bool = false
27+
param azureFunctionToolSupported bool = false
2728

2829
@description('Azure region of the deployment')
2930
param location string = resourceGroup().location
@@ -272,6 +273,18 @@ resource defaultStorage 'Microsoft.Storage/storageAccounts@2022-05-01' = if(!sto
272273
}
273274
allowSharedKeyAccess: false // Enforce Azure AD authentication
274275
}
276+
277+
resource queueServices 'queueServices' = if (azureFunctionToolSupported) {
278+
name: 'default'
279+
280+
resource azureFunctionInputQueue 'queues' = {
281+
name: 'input-queue'
282+
}
283+
284+
resource azureFunctionOutputQueue 'queues' = {
285+
name: 'output-queue'
286+
}
287+
}
275288
}
276289

277290
/* -------------------------------------------- Role Assignments -------------------------------------------- */

0 commit comments

Comments
 (0)