Skip to content

Commit d2edc9b

Browse files
dharakumarmsftdharakumarmsft
committed
Fix overlapping roles
1 parent ee5fbc2 commit d2edc9b

File tree

3 files changed

+14
-178
lines changed

3 files changed

+14
-178
lines changed

‎scenarios/Agents/setup/network-secured-agent/azuredeploy.json‎

Lines changed: 4 additions & 152 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.33.93.31351",
8-
"templateHash": "6468218768722945213"
8+
"templateHash": "13610358180001906492"
99
}
1010
},
1111
"parameters": {
@@ -327,7 +327,7 @@
327327
"_generator": {
328328
"name": "bicep",
329329
"version": "0.33.93.31351",
330-
"templateHash": "3058877073778301143"
330+
"templateHash": "2515541218015614919"
331331
}
332332
},
333333
"parameters": {
@@ -884,155 +884,6 @@
884884
"[resourceId('Microsoft.KeyVault/vaults', parameters('keyvaultName'))]",
885885
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]"
886886
]
887-
},
888-
{
889-
"condition": "[not(parameters('aiServicesExists'))]",
890-
"type": "Microsoft.Resources/deployments",
891-
"apiVersion": "2022-09-01",
892-
"name": "[format('dependencies-{0}-cogsvc-rbac', parameters('suffix'))]",
893-
"properties": {
894-
"expressionEvaluationOptions": {
895-
"scope": "inner"
896-
},
897-
"mode": "Incremental",
898-
"parameters": {
899-
"suffix": {
900-
"value": "[parameters('suffix')]"
901-
},
902-
"UAIPrincipalId": {
903-
"value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName')), '2023-07-31-preview').principalId]"
904-
}
905-
},
906-
"template": {
907-
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
908-
"contentVersion": "1.0.0.0",
909-
"metadata": {
910-
"_generator": {
911-
"name": "bicep",
912-
"version": "0.33.93.31351",
913-
"templateHash": "199126274513046121"
914-
}
915-
},
916-
"parameters": {
917-
"UAIPrincipalId": {
918-
"type": "string",
919-
"metadata": {
920-
"description": "Principal ID of the managed identity"
921-
}
922-
},
923-
"suffix": {
924-
"type": "string",
925-
"metadata": {
926-
"description": "Unique suffix for role assignment naming"
927-
}
928-
}
929-
},
930-
"resources": [
931-
{
932-
"type": "Microsoft.Authorization/roleAssignments",
933-
"apiVersion": "2022-04-01",
934-
"name": "[guid(subscription().subscriptionId, resourceGroup().id, resourceId('Microsoft.Authorization/roleDefinitions', 'b78c5d69-af96-48a3-bf8d-a8b4d589de94'), parameters('suffix'))]",
935-
"properties": {
936-
"principalId": "[parameters('UAIPrincipalId')]",
937-
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b78c5d69-af96-48a3-bf8d-a8b4d589de94')]",
938-
"principalType": "ServicePrincipal"
939-
}
940-
}
941-
],
942-
"outputs": {
943-
"roleAssignmentId": {
944-
"type": "string",
945-
"value": "[resourceId('Microsoft.Authorization/roleAssignments', guid(subscription().subscriptionId, resourceGroup().id, resourceId('Microsoft.Authorization/roleDefinitions', 'b78c5d69-af96-48a3-bf8d-a8b4d589de94'), parameters('suffix')))]"
946-
}
947-
}
948-
}
949-
},
950-
"dependsOn": [
951-
"[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiServicesName'))]",
952-
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]"
953-
]
954-
},
955-
{
956-
"condition": "[not(parameters('aiSearchExists'))]",
957-
"type": "Microsoft.Resources/deployments",
958-
"apiVersion": "2022-09-01",
959-
"name": "[format('dependencies-{0}-aisearch-rbac', parameters('suffix'))]",
960-
"properties": {
961-
"expressionEvaluationOptions": {
962-
"scope": "inner"
963-
},
964-
"mode": "Incremental",
965-
"parameters": {
966-
"aiProjectId": {
967-
"value": "[parameters('aiSearchName')]"
968-
},
969-
"aiProjectPrincipalId": {
970-
"value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName')), '2023-07-31-preview').principalId]"
971-
},
972-
"aiSearchName": {
973-
"value": "[parameters('aiSearchName')]"
974-
}
975-
},
976-
"template": {
977-
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
978-
"contentVersion": "1.0.0.0",
979-
"metadata": {
980-
"_generator": {
981-
"name": "bicep",
982-
"version": "0.33.93.31351",
983-
"templateHash": "16079856828729639404"
984-
}
985-
},
986-
"parameters": {
987-
"aiSearchName": {
988-
"type": "string",
989-
"metadata": {
990-
"description": "Name of the AI Search service"
991-
}
992-
},
993-
"aiProjectPrincipalId": {
994-
"type": "string",
995-
"metadata": {
996-
"description": "Principal ID of the managed identity"
997-
}
998-
},
999-
"aiProjectId": {
1000-
"type": "string",
1001-
"metadata": {
1002-
"description": "Unique suffix for resource naming"
1003-
}
1004-
}
1005-
},
1006-
"resources": [
1007-
{
1008-
"type": "Microsoft.Authorization/roleAssignments",
1009-
"apiVersion": "2022-04-01",
1010-
"scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]",
1011-
"name": "[guid(subscription().subscriptionId, resourceGroup().id, resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7'), parameters('aiProjectId'))]",
1012-
"properties": {
1013-
"principalId": "[parameters('aiProjectPrincipalId')]",
1014-
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
1015-
"principalType": "ServicePrincipal"
1016-
}
1017-
},
1018-
{
1019-
"type": "Microsoft.Authorization/roleAssignments",
1020-
"apiVersion": "2022-04-01",
1021-
"scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]",
1022-
"name": "[guid(subscription().subscriptionId, resourceGroup().id, resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0'), parameters('aiProjectId'))]",
1023-
"properties": {
1024-
"principalId": "[parameters('aiProjectPrincipalId')]",
1025-
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
1026-
"principalType": "ServicePrincipal"
1027-
}
1028-
}
1029-
]
1030-
}
1031-
},
1032-
"dependsOn": [
1033-
"[resourceId('Microsoft.Search/searchServices', parameters('aiSearchName'))]",
1034-
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]"
1035-
]
1036887
}
1037888
],
1038889
"outputs": {
@@ -1794,7 +1645,8 @@
17941645
},
17951646
"dependsOn": [
17961647
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--hub', parameters('name'), parameters('uniqueSuffix')))]",
1797-
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--identity', parameters('name'), parameters('uniqueSuffix')))]"
1648+
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--identity', parameters('name'), parameters('uniqueSuffix')))]",
1649+
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--private-endpoint', parameters('name'), parameters('uniqueSuffix')))]"
17981650
]
17991651
},
18001652
{

‎scenarios/Agents/setup/network-secured-agent/main.bicep‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,9 @@ module aiProject 'modules-network-secured/network-secured-ai-project.bicep' = {
233233
aiHubId: aiHub.outputs.aiHubID
234234
uaiName: identity.outputs.uaiName
235235
}
236+
dependsOn: [
237+
privateEndpointAndDNS
238+
]
236239
}
237240
module waitScript 'modules-network-secured/common/wait-script.bicep' = {
238241
name: 'wait-script-${uniqueSuffix}-deployment'

‎scenarios/Agents/setup/network-secured-agent/modules-network-secured/network-secured-dependent-resources.bicep‎

Lines changed: 7 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -46,22 +46,22 @@ param aiSearchName string
4646
param storageName string
4747

4848
@description('Model name for deployment')
49-
param modelName string
49+
param modelName string
5050

5151
@description('Model format for deployment')
52-
param modelFormat string
52+
param modelFormat string
5353

5454
@description('Model version for deployment')
55-
param modelVersion string
55+
param modelVersion string
5656

5757
@description('Model deployment SKU name')
58-
param modelSkuName string
58+
param modelSkuName string
5959

6060
@description('Model deployment capacity')
61-
param modelCapacity int
61+
param modelCapacity int
6262

6363
@description('Model/AI Resource deployment location')
64-
param modelLocation string
64+
param modelLocation string
6565

6666
@description('The Kind of AI Service, can be "OpenAI" or "AIService"')
6767
param aisKind string
@@ -337,25 +337,6 @@ module keyVaultAccessAssignment './keyvault-role-assignments.bicep' = if(!keyvau
337337
dependsOn: [ defaultKeyVault ]
338338
}
339339

340-
module cognitiveServicesAccessAssignment './cognitive-services-role-assignments.bicep' = if(!aiServicesExists){
341-
name: 'dependencies-${suffix}-cogsvc-rbac'
342-
params: {
343-
suffix: suffix
344-
UAIPrincipalId: uai.properties.principalId
345-
}
346-
dependsOn: [ defaultAiServices ]
347-
}
348-
349-
module aiSearchAccessAssignment 'ai-search-role-assignments.bicep' = if(!aiSearchExists){
350-
name: 'dependencies-${suffix}-aisearch-rbac'
351-
params: {
352-
aiProjectId: aiSearchName
353-
aiProjectPrincipalId: uai.properties.principalId
354-
aiSearchName: aiSearchName
355-
}
356-
dependsOn: [ defaultAiSearch ]
357-
}
358-
359340
/* -------------------------------------------- Output Variables -------------------------------------------- */
360341

361342
var aiServiceParts = aiServicesExists ? split(existingAiServices.id, '/') : split(defaultAiServices.id, '/')
@@ -366,7 +347,7 @@ output aiServicesName string = aiServicesExists ? existingAiServices.name : def
366347
output aiservicesID string = aiServicesExists ? existingAiServices.id : defaultAiServices.id
367348
output aiservicesTarget string = aiServicesExists ? existingAiServices.properties.endpoint : defaultAiServices.properties.endpoint
368349
output aiServiceAccountResourceGroupName string = aiServiceParts[4]
369-
output aiServiceAccountSubscriptionId string = aiServiceParts[2]
350+
output aiServiceAccountSubscriptionId string = aiServiceParts[2]
370351

371352
output aiSearchName string = aiSearchExists ? existingAiSearch.name : defaultAiSearch.name
372353
output aisearchID string = aiSearchExists ? existingAiSearch.id : defaultAiSearch.id

0 commit comments

Comments
 (0)