Azure AI Foundry Pattern Module

Deploys Azure AI Foundry (account, projects, agent service, connections, RBAC) and lets you either bring your own dependent data services or have the module create them for you. Use BYOR for production AI landing zones, CYOR for POCs.

What this module deploys

Category	Resources	Notes
Core (always deployed)	AI Foundry account Projects Connections RBAC Resource locks Agent capability host (optional)	Module-owned.
Dependent data services (BYOR or CYOR)	Key Vault Storage Account Cosmos DB AI Search	Either bring existing IDs (BYOR) or let the module create them (CYOR). See Production guidance.
Networking (private deployments)	Foundry private endpoint VNet, subnets, private DNS (example) Bastion, jump VM (example)	Foundry PE is module-owned. VNet / DNS / Bastion / VM live in the examples and in your landing zone. Designed to pair with the AI Landing Zone Accelerator.
Observability	Diagnostic settings Log Analytics workspace (example)	Workspace lives in the example / landing zone.

Production guidance: BYOR vs CYOR

This module supports two ways of providing the dependent data services (Key Vault, Storage Account, Cosmos DB, AI Search):

Mode	What it does	Resources you own	Use it for
BYOR (Bring Your Own Resource)	You provision the dependent data services outside this module (typically in your landing zone) and pass their IDs in as variables. The module only wires up connections, RBAC, and the Foundry account itself.	Key Vault Storage Account Cosmos DB AI Search	Production. This is the only supported path for production AI landing zones.
CYOR (Create Your Own Resource, the in-module path)	The module provisions the dependent data services for you with opinionated defaults.	Key Vault Storage Account Cosmos DB AI Search (created by the module)	POC / MVP / demos only. Fast path to a working Foundry environment when you don't yet have a landing zone.

Why BYOR is the production path

• Lifecycle separation. Data services typically outlive the Foundry account they back. Owning them outside the pattern module means a terraform destroy of the Foundry stack cannot take down a Cosmos DB or Storage account that other workloads depend on.
• Governance and policy. In an AI landing zone, Key Vault / Storage / Cosmos / Search are governed by platform teams (naming, encryption, network access, diagnostic settings, DINE/Modify policies, private DNS). Letting this module create them re-introduces drift with those platform controls.
• Reduced blast radius and dependencies. BYOR keeps this module focused on what is genuinely Foundry-specific (the account, projects, connections, RBAC, agent capability host) and removes long dependency chains during plan/apply.
• Shared resources across projects/environments. Production deployments commonly share one Cosmos DB or one Storage account across multiple Foundry projects or environments. That sharing only works cleanly when those resources live outside any single module instance.
• Multi-region and cross-region patterns. PE placement, regional pinning, and cross-region wiring are landing-zone concerns, not module concerns.

What this means for issues and feature requests

• Feature requests that only affect the CYOR path (e.g., exposing additional knobs on the module-created Storage account, Key Vault, Cosmos DB, AI Search, or their private endpoints) will generally not be accepted. The recommended fix is to switch to BYOR and configure those properties on your own resources.
• Feature requests that affect the Foundry account, projects, agent service, connections, RBAC, or the Foundry account's own private endpoint apply to both modes and are in scope regardless of BYOR/CYOR.
• See the standard-*-byor examples for reference BYOR deployments.

Example Deployments

Example	Description	Key Features
basic	Minimal AI Foundry deployment	AI Foundry + Project only, public access
standard-public	Full-featured public deployment	All services, public endpoints, complete setup
standard-public-byor	Public deployment with existing resources	Uses existing Storage/KeyVault/Cosmos/Search
standard-private	Enterprise-grade private deployment	Private endpoints, VNet isolation, Bastion access
standard-private-byor	Private deployment with existing resources	Private + existing resources combination

Requirements

The following requirements are needed by this module:

• terraform (>= 1.12, < 2.0)

• azapi (~> 2.12)

• azurerm (~> 4.38)

• modtm (~> 0.3)

• random (~> 3.7)

• time (~> 0.13)

Resources

The following resources are used by this module:

• azapi_resource.ai_agent_capability_host (resource)
• azapi_resource.ai_foundry (resource)
• azapi_resource.ai_model_deployment (resource)
• azapi_resource.ai_search (resource)
• azapi_update_resource.ai_foundry_cmk (resource)
• azurerm_monitor_diagnostic_setting.this (resource)
• azurerm_monitor_diagnostic_setting.this_aisearch (resource)
• azurerm_private_endpoint.ai_foundry (resource)
• azurerm_private_endpoint.pe_aisearch (resource)
• azurerm_private_endpoint.unmanaged_ai_foundry (resource)
• azurerm_private_endpoint.unmanaged_pe_aisearch (resource)
• azurerm_role_assignment.cmk_key_vault_crypto_user (resource)
• azurerm_role_assignment.foundry_role_assignments (resource)
• azurerm_role_assignment.this_aisearch (resource)
• modtm_telemetry.telemetry (resource)
• random_string.resource_token (resource)
• random_uuid.telemetry (resource)
• time_sleep.ai_foundry_wait (resource)
• time_sleep.cmk_rbac_wait (resource)
• azapi_client_config.telemetry (data source)
• azurerm_client_config.current (data source)
• azurerm_key_vault.cmk (data source)
• azurerm_key_vault_key.cmk (data source)
• azurerm_user_assigned_identity.ai_foundry_account (data source)
• azurerm_user_assigned_identity.cmk (data source)
• modtm_module_source.telemetry (data source)

Required Inputs

The following input variables are required:

base_name

Description: The name prefix for the AI Foundry resources.

Type: string

location

Description: Azure region where the resource should be deployed.

Type: string

resource_group_resource_id

Description: The resource group resource id where the module resources will be deployed.

Type: string

Optional Inputs

The following input variables are optional (have default values):

ai_foundry

Description: Configuration object for the Azure AI Foundry service to be created for AI workloads and model management.

• name - (Optional) The name of the AI Foundry service. If not provided, a name will be generated.
• disable_local_auth - (Optional) Whether to disable local authentication for the AI Foundry service. Default is false.
• allow_project_management - (Optional) Whether to allow project management capabilities in the AI Foundry service. Default is true.
• create_ai_agent_service - (Optional) Whether to create an AI agent service as part of the AI Foundry deployment. Default is false.
• network_injections - (Optional) List of network injection configurations for the AI Foundry service.
  • scenario - (Optional) The scenario for the network injection. Default is "agent".
  • subnetArmId - The subnet ARM ID for the AI agent service.
  • useMicrosoftManagedNetwork - (Optional) Whether to use Microsoft managed network for the injection. Default is false.
• private_dns_zone_resource_ids - (Optional) The resource IDs of the existing private DNS zones for AI Foundry. Required when create_private_endpoints is true and private_endpoint.unmanaged_dns_zone_group_enabled is false.
• sku - (Optional) The SKU of the AI Foundry service. Default is "S0".
• public_network_access_enabled - (Optional) Override the public network access setting on the Foundry account. When null (default), the value is derived from create_private_endpoints (false when private endpoints are enabled, true otherwise). Set to true or false to override.
• network_acls - (Optional) Network ACLs applied to the Foundry account. When null (default), the account allows traffic from all networks. Set to restrict traffic when running in production landing zones.
  • default_action - (Optional) Allow or Deny. Default Allow.
  • bypass - (Optional) Bypass rule for trusted Azure services. Use AzureServices to permit Microsoft services to bypass the rules.
  • ip_rules - (Optional) List of CIDR ranges or IPv4 addresses allowed inbound access.
  • virtual_network_rules - (Optional) List of subnet objects allowed inbound access. Each entry requires subnet_resource_id and optionally ignore_missing_vnet_service_endpoint.
• private_endpoint - (Optional) Override block for the AI Foundry account private endpoint. All fields are optional and fall back to the root-level private_endpoint_subnet_resource_id, resource_group_resource_id, location, and the top-level private_dns_zone_resource_ids when null. Used when the Foundry account PE must live in a different resource group, region, subnet, or use unmanaged DNS.
  • resource_group_resource_id - (Optional) Resource ID of the resource group hosting the private endpoint. Defaults to the module's resource group.
  • location - (Optional) Azure region for the private endpoint. Defaults to the module's location.
  • subnet_resource_id - (Optional) Subnet resource ID for the private endpoint NIC. Defaults to private_endpoint_subnet_resource_id.
  • private_dns_zone_resource_ids - (Optional) Override list of private DNS zone resource IDs. Defaults to ai_foundry.private_dns_zone_resource_ids.
  • unmanaged_dns_zone_group_enabled - (Optional) When true, no private_dns_zone_group is created on the private endpoint. Use this when DNS A records are produced by an Azure Policy (DINE/Modify) on the platform DNS zones in a hub subscription. Default false.
• managed_identities - (Optional) Identity configuration for the AI Foundry account.
  • system_assigned - (Optional) Enable the system-assigned managed identity. Default true.
  • user_assigned_resource_ids - (Optional) Set of user-assigned managed identity resource IDs to attach to the account. When the Foundry account also creates an AI Agent service, every user-assigned identity is granted the Cosmos DB and Storage data-plane roles required by the Standard Agent Setup.
• customer_managed_key - (Optional) Customer-managed key encryption configuration. Requires a Key Vault with an existing key and a user-assigned managed identity with "Key Vault Crypto User" role on the Key Vault.
  • key_vault_resource_id - Resource ID of the Key Vault containing the encryption key.
  • key_name - Name of the Key Vault key to use for encryption.
  • key_version - (Optional) Version of the Key Vault key. If not specified, uses the latest version.
  • user_assigned_identity_resource_id - Resource ID of the user-assigned managed identity with access to the Key Vault.
• role_assignments - (Optional) Map of role assignments to create on the AI Foundry service. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
  • role_definition_id_or_name - The role definition ID or name to assign.
  • principal_id - The principal ID to assign the role to.
  • description - (Optional) Description of the role assignment.
  • skip_service_principal_aad_check - (Optional) Whether to skip AAD check for service principal.
  • condition - (Optional) Condition for the role assignment.
  • condition_version - (Optional) Version of the condition.
  • delegated_managed_identity_resource_id - (Optional) Resource ID of the delegated managed identity.
  • principal_type - (Optional) Type of the principal (User, Group, ServicePrincipal).

Type:

object({
    name                     = optional(string, null)
    disable_local_auth       = optional(bool, false)
    allow_project_management = optional(bool, true)
    create_ai_agent_service  = optional(bool, false)
    network_injections = optional(list(object({
      scenario                   = optional(string, "agent")
      subnetArmId                = string
      useMicrosoftManagedNetwork = optional(bool, false)
    })), null)
    private_dns_zone_resource_ids = optional(list(string), [])
    sku                           = optional(string, "S0")
    public_network_access_enabled = optional(bool, null)
    network_acls = optional(object({
      default_action = optional(string, "Allow")
      bypass         = optional(string, null)
      ip_rules       = optional(list(string), [])
      virtual_network_rules = optional(list(object({
        subnet_resource_id                   = string
        ignore_missing_vnet_service_endpoint = optional(bool, false)
      })), [])
    }), null)
    managed_identities = optional(object({
      system_assigned            = optional(bool, true)
      user_assigned_resource_ids = optional(set(string), [])
    }), { system_assigned = true, user_assigned_resource_ids = [] })
    customer_managed_key = optional(object({
      key_vault_resource_id              = string
      key_name                           = string
      key_version                        = optional(string, null)
      user_assigned_identity_resource_id = string
    }), null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
  })

Default: {}

ai_model_deployments

Description: Configuration for AI model deployments (including OpenAI). Each deployment includes:

• name - The name of the deployment
• rai_policy_name - (Optional) The name of the RAI policy. Default is "Microsoft.DefaultV2".
• version_upgrade_option - (Optional) How to handle version upgrades (default: "OnceNewDefaultVersionAvailable")
• model - The model configuration:
  • format - The format of the model (e.g., "OpenAI")
  • name - The name of the model to deploy
  • version - The version of the model
• scale - The scaling configuration:
  • type - The scaling type (e.g., "Standard")
  • capacity - (Optional) The capacity of the deployment
  • family - (Optional) The family of the deployment
  • size - (Optional) The size of the deployment
  • tier - (Optional) The pricing tier for the deployment

Type:

map(object({
    name                   = string
    rai_policy_name        = optional(string, "Microsoft.DefaultV2")
    version_upgrade_option = optional(string, "OnceNewDefaultVersionAvailable")
    model = object({
      format  = string
      name    = string
      version = string
    })
    scale = object({
      capacity = optional(number)
      family   = optional(string)
      size     = optional(string)
      tier     = optional(string)
      type     = string
    })
  }))

Default: {}

ai_projects

Description: Configuration map for AI Foundry projects to be created. Each project can have its own settings and connections to dependent resources.

• map key - The key for the map entry. This key should match the dependent resources keys when creating connections.
  • name - The name of the AI Foundry project.
  • sku - (Optional) The SKU of the AI Foundry project. Default is "S0".
  • display_name - The display name of the AI Foundry project.
  • description - The description of the AI Foundry project.
  • create_project_connections - (Optional) Whether to create connections to dependent resources. Default is false.
  • cosmos_db_connection - (Optional) Configuration for Cosmos DB connection.
    • existing_resource_id - (Optional) The resource ID of an existing Cosmos DB account to connect to.
    • new_resource_map_key - (Optional) The map key of a new Cosmos DB account to be created and connected.
  • ai_search_connection - (Optional) Configuration for AI Search connection.
    • existing_resource_id - (Optional) The resource ID of an existing AI Search service to connect to.
    • new_resource_map_key - (Optional) The map key of a new AI Search service to be created and connected.
  • key_vault_connection - (Optional) Configuration for Key Vault connection.
    • existing_resource_id - (Optional) The resource ID of an existing Key Vault to connect to.
    • new_resource_map_key - (Optional) The map key of a new Key Vault to be created and connected.
  • storage_account_connection - (Optional) Configuration for Storage Account connection.
    • existing_resource_id - (Optional) The resource ID of an existing Storage Account to connect to.
    • new_resource_map_key - (Optional) The map key of a new Storage Account to be created and connected.

Type:

map(object({
    name                       = string
    sku                        = optional(string, "S0")
    display_name               = string
    description                = string
    create_project_connections = optional(bool, false)
    cosmos_db_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
    ai_search_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
    key_vault_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
    storage_account_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
  }))

Default: {}

ai_search_definition

Description: Configuration object for the Azure AI Search service to be created as part of the enterprise and public knowledge services.

• map key - The key for the map entry. This key should match the AI project key when creating multiple projects with multiple AI search services.
  • existing_resource_id - (Optional) The resource ID of an existing AI Search service to use. If provided, the service will not be created and the other inputs will be ignored.
  • name - (Optional) The name of the AI Search service. If not provided, a name will be generated.
  • private_dns_zone_resource_id - (Optional) The resource ID of the existing private DNS zone for AI Search. If not provided or set to null, no DNS zone group will be created.
  • diagnostic_settings - (Optional) A map of diagnostic settings to create. Each entry follows the AVM diagnostic_settings interface.
  • sku - (Optional) The SKU of the AI Search service. Default is "standard".
  • local_authentication_enabled - (Optional) Whether local authentication is enabled. Default is true.
  • partition_count - (Optional) The number of partitions for the search service. Default is 1.
  • replica_count - (Optional) The number of replicas for the search service. Default is 2.
  • semantic_search - (Optional) The semantic search tier. Possible values are "disabled", "free", or "standard". Default is "disabled".
  • hosting_mode - (Optional) The hosting mode for the search service. Default is "default".
  • public_network_access_enabled - (Optional) Overrides public network access on the search service. Default is null, in which case the value is derived from create_private_endpoints (disabled when private endpoints are created, enabled otherwise).
  • network_rule_set - (Optional) Inbound network rules applied to the search service. Only takes effect when public network access is enabled.
    • bypass - (Optional) Whether trusted Azure services may bypass the rules. Possible values are "None" and "AzureServices". Default is "None".
    • ip_rules - (Optional) List of IPv4 addresses or CIDR ranges allowed inbound access. Default is [].
  • tags - (Optional) Map of tags to assign to the AI Search service.
  • role_assignments - (Optional) Map of role assignments to create on the AI Search service. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    • role_definition_id_or_name - The role definition ID or name to assign.
    • principal_id - The principal ID to assign the role to.
    • description - (Optional) Description of the role assignment.
    • skip_service_principal_aad_check - (Optional) Whether to skip AAD check for service principal.
    • condition - (Optional) Condition for the role assignment.
    • condition_version - (Optional) Version of the condition.
    • delegated_managed_identity_resource_id - (Optional) Resource ID of the delegated managed identity.
    • principal_type - (Optional) Type of the principal (User, Group, ServicePrincipal).
  • enable_telemetry - (Optional) Whether telemetry is enabled for the AI Search module. Default is true.

Type:

map(object({
    existing_resource_id         = optional(string, null)
    name                         = optional(string)
    private_dns_zone_resource_id = optional(string, null)
    diagnostic_settings = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    sku                           = optional(string, "standard")
    local_authentication_enabled  = optional(bool, true)
    partition_count               = optional(number, 1)
    replica_count                 = optional(number, 2)
    semantic_search               = optional(string, "disabled")
    hosting_mode                  = optional(string, "default")
    public_network_access_enabled = optional(bool, null)
    network_rule_set = optional(object({
      bypass   = optional(string, "None")
      ip_rules = optional(list(string), [])
    }), {})
    tags = optional(map(string), {})
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    enable_telemetry = optional(bool, true)
  }))

Default: {}

cognitive_services_api_version

Description: API version used for Microsoft.CognitiveServices account resources. Use 2025-07-01-preview for compatibility with AzAPI provider versions that do not include 2025-10-01-preview.

Type: string

Default: "2025-10-01-preview"

cosmosdb_definition

Description: Configuration object for the Azure Cosmos DB account to be created for GenAI services.

• map key - The key for the map entry. This key should match the AI project key when creating multiple projects and multiple CosmosDB accounts.
  • existing_resource_id - (Optional) The resource ID of an existing Cosmos DB account to use. If provided, the account will not be created and the other inputs will be ignored.
  • private_dns_zone_resource_id - (Optional) The resource ID of the existing private DNS zone for Cosmos DB. If not provided or set to null, no DNS zone group will be created.
  • diagnostic_settings - (Optional) A map of diagnostic settings to create. Each entry follows the AVM diagnostic_settings interface.
  • name - (Optional) The name of the Cosmos DB account. If not provided, a name will be generated.
  • secondary_regions - (Optional) List of secondary regions for geo-replication.
    • location - The Azure region for the secondary location.
    • zone_redundant - (Optional) Whether zone redundancy is enabled for the secondary region. Default is true.
    • failover_priority - (Optional) The failover priority for the secondary region. Default is 0.
  • public_network_access_enabled - (Optional) Whether public network access is enabled. Default is false.
  • analytical_storage_enabled - (Optional) Whether analytical storage is enabled. Default is false. Azure no longer permits enabling Analytical Storage during account creation; set this to true only on accounts that already had it enabled.
  • automatic_failover_enabled - (Optional) Whether automatic failover is enabled. Default is false.
  • local_authentication_disabled - (Optional) Whether local authentication is disabled. Default is true.
  • partition_merge_enabled - (Optional) Whether partition merge is enabled. Default is false.
  • multiple_write_locations_enabled - (Optional) Whether multiple write locations are enabled. Default is false.
  • ip_range_filter - (Optional) Set of IP addresses or CIDR ranges allowed to reach the Cosmos DB account. Defaults to the Azure portal and global Azure datacenter source IPs documented at https://learn.microsoft.com/azure/cosmos-db/how-to-configure-firewall. Set to [] to remove the allowlist.
  • network_acl_bypass_for_azure_services - (Optional) Whether Azure services can bypass the network ACLs. Default is true.
  • network_acl_bypass_resource_ids - (Optional) Set of resource IDs allowed to bypass the network ACLs. Default is [].
  • virtual_network_rules - (Optional) Set of subnets allowed to reach the Cosmos DB account. Default is [].
    • subnet_id - The resource ID of the subnet to allow.
  • analytical_storage_config - (Optional) Analytical storage configuration.
    • schema_type - The schema type for analytical storage.
  • consistency_policy - (Optional) Consistency policy configuration.
    • max_interval_in_seconds - (Optional) Maximum staleness interval in seconds. Default is 300.
    • max_staleness_prefix - (Optional) Maximum staleness prefix. Default is 100001.
    • consistency_level - (Optional) The consistency level. Default is "Session".
  • backup - (Optional) Backup configuration.
    • retention_in_hours - (Optional) Backup retention in hours.
    • interval_in_minutes - (Optional) Backup interval in minutes.
    • storage_redundancy - (Optional) Storage redundancy for backups.
    • type - (Optional) The backup type.
    • tier - (Optional) The backup tier.
  • capabilities - (Optional) Set of capabilities to enable on the Cosmos DB account.
    • name - The name of the capability.
  • capacity - (Optional) Capacity configuration.
    • total_throughput_limit - (Optional) Total throughput limit. Default is -1 (unlimited).
  • cors_rule - (Optional) CORS rule configuration.
    • allowed_headers - Set of allowed headers.
    • allowed_methods - Set of allowed HTTP methods.
    • allowed_origins - Set of allowed origins.
    • exposed_headers - Set of exposed headers.
    • max_age_in_seconds - (Optional) Maximum age in seconds for CORS.
  • role_assignments - (Optional) Map of role assignments to create on the Cosmos DB account. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    • role_definition_id_or_name - The role definition ID or name to assign.
    • principal_id - The principal ID to assign the role to.
    • description - (Optional) Description of the role assignment.
    • skip_service_principal_aad_check - (Optional) Whether to skip AAD check for service principal.
    • condition - (Optional) Condition for the role assignment.
    • condition_version - (Optional) Version of the condition.
    • delegated_managed_identity_resource_id - (Optional) Resource ID of the delegated managed identity.
    • principal_type - (Optional) Type of the principal (User, Group, ServicePrincipal).
  • tags - (Optional) Map of tags to assign to the Cosmos DB account.

Type:

map(object({
    existing_resource_id         = optional(string, null)
    private_dns_zone_resource_id = optional(string, null)
    diagnostic_settings = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    name = optional(string)
    secondary_regions = optional(list(object({
      location          = string
      zone_redundant    = optional(bool, true)
      failover_priority = optional(number, 0)
    })), [])
    public_network_access_enabled    = optional(bool, false)
    analytical_storage_enabled       = optional(bool, false)
    automatic_failover_enabled       = optional(bool, true)
    local_authentication_disabled    = optional(bool, true)
    partition_merge_enabled          = optional(bool, false)
    multiple_write_locations_enabled = optional(bool, false)
    # Default allowlist is the Azure portal plus global Azure datacenter source IPs: https://learn.microsoft.com/azure/cosmos-db/how-to-configure-firewall
    ip_range_filter = optional(set(string), [
      "168.125.123.255",
      "170.0.0.0/24",
      "0.0.0.0",
      "104.42.195.92", "40.76.54.131", "52.176.6.30", "52.169.50.45", "52.187.184.26"
    ])
    network_acl_bypass_for_azure_services = optional(bool, true)
    network_acl_bypass_resource_ids       = optional(set(string), [])
    virtual_network_rules = optional(set(object({
      subnet_id = string
    })), [])
    analytical_storage_config = optional(object({
      schema_type = string
    }), null)
    consistency_policy = optional(object({
      max_interval_in_seconds = optional(number, 300)
      max_staleness_prefix    = optional(number, 100001)
      consistency_level       = optional(string, "Session")
    }), {})
    backup = optional(object({
      retention_in_hours  = optional(number)
      interval_in_minutes = optional(number)
      storage_redundancy  = optional(string)
      type                = optional(string)
      tier                = optional(string)
    }), {})
    capabilities = optional(set(object({
      name = string
    })), [])
    capacity = optional(object({
      total_throughput_limit = optional(number, -1)
    }), {})
    cors_rule = optional(object({
      allowed_headers    = set(string)
      allowed_methods    = set(string)
      allowed_origins    = set(string)
      exposed_headers    = set(string)
      max_age_in_seconds = optional(number, null)
    }), null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    tags = optional(map(string), {})
  }))

Default: {}

create_byor

Description: Whether to create resources such as AI Search, Cosmos DB, Key Vault, and Storage Account in this deployment. If set to false, these resources will not be created or linked, and the module will only create the AI Foundry account and project.

Type: bool

Default: false

create_private_endpoints

Description: Whether to create private endpoints for AI Foundry, Cosmos DB, Key Vault, and AI Search. If set to false, private endpoints will not be created.

Type: bool

Default: false

diagnostic_settings

Description: A map of diagnostic settings to create on the AI Foundry account (Cognitive Services account). The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

• name - (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
• log_categories - (Optional) A set of log categories to send to the log analytics workspace. Defaults to [].
• log_groups - (Optional) A set of log groups to send to the log analytics workspace. Defaults to ["allLogs"].
• metric_categories - (Optional) A set of metric categories to send to the log analytics workspace. Defaults to ["AllMetrics"].
• log_analytics_destination_type - (Optional) The destination type for the diagnostic setting. Possible values are Dedicated and AzureDiagnostics. Defaults to Dedicated.
• workspace_resource_id - (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
• storage_account_resource_id - (Optional) The resource ID of the storage account to send logs and metrics to.
• event_hub_authorization_rule_resource_id - (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
• event_hub_name - (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
• marketplace_partner_resource_id - (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.

Type:

map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

enable_telemetry

Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.

Type: bool

Default: true

key_vault_definition

Description: Configuration object for the Azure Key Vault to be created for GenAI services.

• map key - The key for the map entry. This key should match the AI project key when creating multiple projects with multiple Key Vaults. This can be used in naming, so short alphanumeric keys are required to avoid hitting naming length limits for the Key Vault when using the base name naming option.
  • existing_resource_id - (Optional) The resource ID of an existing Key Vault to use. If provided, the vault will not be created and the other inputs will be ignored.
  • name - (Optional) The name of the Key Vault. If not provided, a name will be generated.
  • private_dns_zone_resource_id - (Optional) The resource ID of the existing private DNS zone for Key Vault. If not provided or set to null, no DNS zone group will be created.
  • diagnostic_settings - (Optional) A map of diagnostic settings to create. Each entry follows the AVM diagnostic_settings interface.
  • sku - (Optional) The SKU of the Key Vault. Default is "standard".
  • tenant_id - (Optional) The tenant ID for the Key Vault. If not provided, the current tenant will be used.
  • public_network_access_enabled - (Optional) Overrides public network access on the Key Vault. Default is null, in which case the value is derived from create_private_endpoints (disabled when private endpoints are created, enabled otherwise).
  • network_acls - (Optional) Network access control list applied to the Key Vault. Defaults to allowing all networks with an AzureServices bypass, which preserves the module's previous behaviour.
    • bypass - (Optional) Traffic permitted to bypass the rules. Possible values are "AzureServices" and "None". Default is "AzureServices".
    • default_action - (Optional) Action taken when no rule matches. Possible values are "Allow" and "Deny". Default is "Allow".
    • ip_rules - (Optional) List of IPv4 addresses or CIDR ranges allowed access. Default is [].
    • virtual_network_subnet_ids - (Optional) List of subnet resource IDs allowed access. Default is [].
  • role_assignments - (Optional) Map of role assignments to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    • role_definition_id_or_name - The role definition ID or name to assign.
    • principal_id - The principal ID to assign the role to.
    • description - (Optional) Description of the role assignment.
    • skip_service_principal_aad_check - (Optional) Whether to skip AAD check for service principal.
    • condition - (Optional) Condition for the role assignment.
    • condition_version - (Optional) Version of the condition.
    • delegated_managed_identity_resource_id - (Optional) Resource ID of the delegated managed identity.
    • principal_type - (Optional) Type of the principal (User, Group, ServicePrincipal).
  • tags - (Optional) Map of tags to assign to the Key Vault.

Type:

map(object({
    existing_resource_id         = optional(string, null)
    name                         = optional(string)
    private_dns_zone_resource_id = optional(string, null)
    diagnostic_settings = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    sku                           = optional(string, "standard")
    tenant_id                     = optional(string)
    public_network_access_enabled = optional(bool, null)
    network_acls = optional(object({
      bypass                     = optional(string, "AzureServices")
      default_action             = optional(string, "Allow")
      ip_rules                   = optional(list(string), [])
      virtual_network_subnet_ids = optional(list(string), [])
    }), {})
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    tags = optional(map(string), {})
  }))

Default: {}

private_endpoint_resource_group_location

Description: (Optional) The resource group location for private endpoints.

Type: string

Default: null

private_endpoint_resource_group_name

Description: (Optional) The resource group name for private endpoints.

Type: string

Default: null

private_endpoint_subnet_resource_id

Description: (Optional) The subnet ID for private endpoints.

Type: string

Default: null

private_endpoints_manage_dns_zone_groups

Description: Whether to manage private DNS zone groups for the private endpoints created by this module. If set to false, the private DNS zone groups will not be defined or managed.

Type: bool

Default: true

resource_names

Description: Custom names for each resource. If not provided, names will be generated using base_name or name.

Type:

object({
    ai_agent_host                   = optional(string)
    ai_foundry                      = optional(string)
    ai_foundry_project              = optional(string)
    ai_foundry_project_display_name = optional(string)
  })

Default: {}

storage_account_definition

Description: Configuration object for the Azure Storage Account to be created for GenAI services.

• map key - The key for the map entry. This key should match the AI project key when creating multiple projects with multiple Storage Accounts. This can be used in naming, so short alphanumeric keys are required to avoid hitting naming length limits for the Storage Account when using the base name naming option.
  • existing_resource_id - (Optional) The resource ID of an existing Storage Account to use. If provided, the account will not be created and the other inputs will be ignored.
  • diagnostic_settings_storage_account - (Optional) A map of diagnostic settings to create on the storage account. Each entry follows the AVM diagnostic_settings interface.
  • name - (Optional) The name of the Storage Account. If not provided, a name will be generated.
  • account_kind - (Optional) The kind of storage account. Default is "StorageV2".
  • account_tier - (Optional) The performance tier of the storage account. Default is "Standard".
  • account_replication_type - (Optional) The replication type for the storage account. Default is "ZRS".
  • endpoints - (Optional) Map of endpoint configurations to enable. Default includes blob endpoint.
    • type - The type of endpoint (e.g., "blob", "file", "queue", "table").
    • private_dns_zone_resource_id - (Optional) The resource ID of the existing private DNS zone for the endpoint. If not provided or set to null, no DNS zone group will be created.
  • access_tier - (Optional) The access tier for the storage account. Default is "Hot".
  • shared_access_key_enabled - (Optional) Whether shared access keys are enabled. Default is false.
  • public_network_access_enabled - (Optional) Overrides public network access on the Storage Account. Default is null, in which case the value is derived from create_private_endpoints (disabled when private endpoints are created, enabled otherwise).
  • network_rules - (Optional) Storage account firewall configuration. Default is null, in which case the module keeps its previous behaviour: deny-by-default with an AzureServices bypass when create_private_endpoints is true, and no network rules at all when it is false.
    • bypass - (Optional) Traffic permitted to bypass the rules. Any combination of "Logging", "Metrics", "AzureServices" or "None". Default is ["AzureServices"].
    • default_action - (Optional) Action taken when no rule matches. Possible values are "Allow" and "Deny". Default is "Deny".
    • ip_rules - (Optional) Set of public IPv4 addresses or CIDR ranges allowed access. RFC 1918 private ranges are not permitted by Azure. Default is [].
    • virtual_network_subnet_ids - (Optional) Set of subnet resource IDs allowed access. Default is [].
    • private_link_access - (Optional) List of resource access rules granting private link access. Default is null.
      • endpoint_resource_id - The resource ID granted access.
      • endpoint_tenant_id - (Optional) The tenant ID of the resource. Defaults to the current tenant.
  • role_assignments - (Optional) Map of role assignments to create on the Storage Account. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    • role_definition_id_or_name - The role definition ID or name to assign.
    • principal_id - The principal ID to assign the role to.
    • description - (Optional) Description of the role assignment.
    • skip_service_principal_aad_check - (Optional) Whether to skip AAD check for service principal.
    • condition - (Optional) Condition for the role assignment.
    • condition_version - (Optional) Version of the condition.
    • delegated_managed_identity_resource_id - (Optional) Resource ID of the delegated managed identity.
    • principal_type - (Optional) Type of the principal (User, Group, ServicePrincipal).
  • tags - (Optional) Map of tags to assign to the Storage Account.

Type:

map(object({
    existing_resource_id = optional(string, null)
    diagnostic_settings_storage_account = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    name                     = optional(string, null)
    account_kind             = optional(string, "StorageV2")
    account_tier             = optional(string, "Standard")
    account_replication_type = optional(string, "ZRS")
    endpoints = optional(map(object({
      type                         = string
      private_dns_zone_resource_id = optional(string, null)
      })), {
      blob = {
        type = "blob"
      }
    })
    access_tier                   = optional(string, "Hot")
    shared_access_key_enabled     = optional(bool, false)
    public_network_access_enabled = optional(bool, null)
    network_rules = optional(object({
      bypass                     = optional(set(string), ["AzureServices"])
      default_action             = optional(string, "Deny")
      ip_rules                   = optional(set(string), [])
      virtual_network_subnet_ids = optional(set(string), [])
      private_link_access = optional(list(object({
        endpoint_resource_id = string
        endpoint_tenant_id   = optional(string)
      })), null)
    }), null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    tags = optional(map(string), {})

    #TODO:
    # Implement subservice passthrough here
  }))

Default: {}

tags

Description: (Optional) Tags to be applied to all resources.

Type: map(string)

Default: null

Outputs

The following outputs are exported:

ai_agent_account_capability_host_id

Description: The resource ID of the account-level AI agent capability host.

ai_agent_service_id

Description: The resource ID of the AI agent capability host.

ai_foundry_encryption_status

Description: The encryption configuration status of the AI Foundry account.

ai_foundry_id

Description: The resource ID of the AI Foundry account.

ai_foundry_name

Description: The name of the AI Foundry account.

ai_foundry_project_id

Description: The resource ID of the AI Foundry Project.

ai_foundry_project_internal_id

Description: The internal ID of the AI Foundry project used for container naming.

ai_foundry_project_name

Description: The name of the AI Foundry Project.

ai_foundry_project_system_identity_principal_id

Description: The principal ID of the AI Foundry project's system-assigned managed identity.

ai_model_deployment_ids

Description: The resource IDs of all AI model deployments.

ai_search_id

Description: The resource ID of the AI Search service.

ai_search_name

Description: The name of the AI Search service.

cosmos_db_id

Description: The resource ID of the Cosmos DB account.

cosmos_db_name

Description: The name of the Cosmos DB account.

key_vault_id

Description: The resource ID of the Key Vault.

key_vault_name

Description: The name of the Key Vault.

project_id_guid

Description: The project ID formatted as GUID for container naming (only available when AI agent service is enabled).

resource_group_id

Description: The resource ID of the resource group.

resource_group_name

Description: The name of the resource group.

resource_id

Description: The resource IDs of the AI Foundry resource.

storage_account_id

Description: The resource ID of the storage account.

storage_account_name

Description: The name of the storage account.

Modules

The following Modules are called:

ai_foundry_project

Source: ./modules/ai-foundry-project

Version:

avm_utl_regions

Source: Azure/avm-utl-regions/azurerm

Version: 0.12.0

cosmosdb

Source: Azure/avm-res-documentdb-databaseaccount/azurerm

Version: 0.10.0

key_vault

Source: Azure/avm-res-keyvault-vault/azurerm

Version: 0.10.2

storage_account

Source: Azure/avm-res-storage-storageaccount/azurerm

Version: 0.6.9

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.