Skip to content

Commit cd6a684

Browse files
Dhruvkumar-MicrosoftDhruvkumar-Microsoft
committed
2 parents cf3f326 + f7e5d0d commit cd6a684

File tree

5 files changed

+143
-5
lines changed

5 files changed

+143
-5
lines changed

‎azure.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ metadata:
55
requiredVersions:
66
azd: ">=1.15.0 !=1.17.1"
77
hooks:
8-
postprovision:
8+
postdeploy:
99
windows:
1010
run: |
1111
Write-Host "To upload Team Configurations to Cosmos. Run the following command in PowerShell:"

‎azure_custom.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ services:
4141
continueOnError: false
4242

4343
hooks:
44-
postprovision:
44+
postdeploy:
4545
windows:
4646
run: |
4747
Write-Host "To upload Team Configurations to Cosmos. Run the following command in PowerShell:"

‎infra/main.bicep‎

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -946,13 +946,15 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.17.0' = if (e
946946
}
947947

948948
// ========== Private DNS Zones ========== //
949+
var keyVaultPrivateDNSZone = 'privatelink.${toLower(environment().name) == 'azureusgovernment' ? 'vaultcore.usgovcloudapi.net' : 'vaultcore.azure.net'}'
949950
var privateDnsZones = [
950951
'privatelink.cognitiveservices.azure.com'
951952
'privatelink.openai.azure.com'
952953
'privatelink.services.ai.azure.com'
953954
'privatelink.documents.azure.com'
954955
'privatelink.blob.core.windows.net'
955956
'privatelink.search.windows.net'
957+
keyVaultPrivateDNSZone
956958
]
957959

958960
// DNS Zone Index Constants
@@ -963,6 +965,7 @@ var dnsZoneIndex = {
963965
cosmosDb: 3
964966
blob: 4
965967
search: 5
968+
keyVault: 6
966969
}
967970

968971
// List of DNS zone indices that correspond to AI-related services.
@@ -1550,7 +1553,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
15501553
}
15511554
{
15521555
name: 'AZURE_AI_SEARCH_API_KEY'
1553-
value: ''
1556+
secretRef: 'azure-ai-search-api-key'
15541557
}
15551558
{
15561559
name: 'BING_CONNECTION_NAME'
@@ -1569,6 +1572,14 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
15691572
value: aiFoundryAiServicesModelDeployment.name
15701573
}
15711574
]
1575+
1576+
}
1577+
]
1578+
secrets: [
1579+
{
1580+
name: 'azure-ai-search-api-key'
1581+
keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
1582+
identity: userAssignedIdentity.outputs.resourceId
15721583
}
15731584
]
15741585
}
@@ -1909,13 +1920,68 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
19091920
searchServiceResourceId: searchService.outputs.resourceId
19101921
searchServiceLocation: searchService.outputs.location
19111922
searchServiceName: searchService.outputs.name
1923+
searchApiKey: searchService.outputs.primaryKey
19121924
}
19131925
dependsOn: [
19141926
aiFoundryAiServices
19151927
]
19161928
}
19171929

19181930

1931+
// ========== KeyVault ========== //
1932+
var keyVaultName = 'kv-${solutionSuffix}'
1933+
module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
1934+
name: take('avm.res.key-vault.vault.${keyVaultName}', 64)
1935+
params: {
1936+
name: keyVaultName
1937+
location: location
1938+
tags: tags
1939+
sku: enableScalability ? 'premium' : 'standard'
1940+
publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
1941+
networkAcls: {
1942+
defaultAction: 'Allow'
1943+
}
1944+
enableVaultForDeployment: true
1945+
enableVaultForDiskEncryption: true
1946+
enableVaultForTemplateDeployment: true
1947+
enableRbacAuthorization: true
1948+
enableSoftDelete: true
1949+
softDeleteRetentionInDays: 7
1950+
diagnosticSettings: enableMonitoring
1951+
? [{ workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId }]
1952+
: []
1953+
// WAF aligned configuration for Private Networking
1954+
privateEndpoints: enablePrivateNetworking
1955+
? [
1956+
{
1957+
name: 'pep-${keyVaultName}'
1958+
customNetworkInterfaceName: 'nic-${keyVaultName}'
1959+
privateDnsZoneGroup: {
1960+
privateDnsZoneGroupConfigs: [{ privateDnsZoneResourceId: avmPrivateDnsZones[dnsZoneIndex.keyVault]!.outputs.resourceId }]
1961+
}
1962+
service: 'vault'
1963+
subnetResourceId: virtualNetwork!.outputs.subnetResourceIds[0]
1964+
}
1965+
]
1966+
: []
1967+
// WAF aligned configuration for Role-based Access Control
1968+
roleAssignments: [
1969+
{
1970+
principalId: userAssignedIdentity.outputs.principalId
1971+
principalType: 'ServicePrincipal'
1972+
roleDefinitionIdOrName: 'Key Vault Administrator'
1973+
}
1974+
]
1975+
secrets: [
1976+
{
1977+
name: 'AzureAISearchAPIKey'
1978+
value: searchService.outputs.primaryKey
1979+
}
1980+
]
1981+
enableTelemetry: enableTelemetry
1982+
}
1983+
}
1984+
19191985
// ============ //
19201986
// Outputs //
19211987
// ============ //
@@ -1961,3 +2027,4 @@ output REASONING_MODEL_NAME string = aiFoundryAiServicesReasoningModelDeployment
19612027
output MCP_SERVER_NAME string = 'MACAE MCP Server'
19622028
output MCP_SERVER_DESCRIPTION string = 'MACAE MCP Server Description'
19632029
output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
2030+
output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'

‎infra/main_custom.bicep‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -919,13 +919,15 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.17.0' = if (e
919919
}
920920

921921
// ========== Private DNS Zones ========== //
922+
var keyVaultPrivateDNSZone = 'privatelink.${toLower(environment().name) == 'azureusgovernment' ? 'vaultcore.usgovcloudapi.net' : 'vaultcore.azure.net'}'
922923
var privateDnsZones = [
923924
'privatelink.cognitiveservices.azure.com'
924925
'privatelink.openai.azure.com'
925926
'privatelink.services.ai.azure.com'
926927
'privatelink.documents.azure.com'
927928
'privatelink.blob.core.windows.net'
928929
'privatelink.search.windows.net'
930+
keyVaultPrivateDNSZone
929931
]
930932

931933
// DNS Zone Index Constants
@@ -936,6 +938,7 @@ var dnsZoneIndex = {
936938
cosmosDb: 3
937939
blob: 4
938940
search: 5
941+
keyVault: 6
939942
}
940943

941944
// List of DNS zone indices that correspond to AI-related services.
@@ -1516,7 +1519,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
15161519
}
15171520
{
15181521
name: 'AZURE_AI_SEARCH_API_KEY'
1519-
value: ''
1522+
value: 'azure-ai-search-api-key'
15201523
}
15211524
{
15221525
name: 'BING_CONNECTION_NAME'
@@ -1533,6 +1536,13 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
15331536
]
15341537
}
15351538
]
1539+
secrets: [
1540+
{
1541+
name: 'azure-ai-search-api-key'
1542+
keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
1543+
identity: userAssignedIdentity.outputs.resourceId
1544+
}
1545+
]
15361546
}
15371547
}
15381548

@@ -1880,13 +1890,68 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
18801890
searchServiceResourceId: searchService.outputs.resourceId
18811891
searchServiceLocation: searchService.outputs.location
18821892
searchServiceName: searchService.outputs.name
1893+
searchApiKey: searchService.outputs.primaryKey
18831894
}
18841895
dependsOn: [
18851896
aiFoundryAiServices
18861897
]
18871898
}
18881899

18891900

1901+
// ========== KeyVault ========== //
1902+
var keyVaultName = 'kv-${solutionSuffix}'
1903+
module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
1904+
name: take('avm.res.key-vault.vault.${keyVaultName}', 64)
1905+
params: {
1906+
name: keyVaultName
1907+
location: location
1908+
tags: tags
1909+
sku: enableScalability ? 'premium' : 'standard'
1910+
publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
1911+
networkAcls: {
1912+
defaultAction: 'Allow'
1913+
}
1914+
enableVaultForDeployment: true
1915+
enableVaultForDiskEncryption: true
1916+
enableVaultForTemplateDeployment: true
1917+
enableRbacAuthorization: true
1918+
enableSoftDelete: true
1919+
softDeleteRetentionInDays: 7
1920+
diagnosticSettings: enableMonitoring
1921+
? [{ workspaceResourceId: logAnalyticsWorkspace!.outputs.resourceId }]
1922+
: []
1923+
// WAF aligned configuration for Private Networking
1924+
privateEndpoints: enablePrivateNetworking
1925+
? [
1926+
{
1927+
name: 'pep-${keyVaultName}'
1928+
customNetworkInterfaceName: 'nic-${keyVaultName}'
1929+
privateDnsZoneGroup: {
1930+
privateDnsZoneGroupConfigs: [{ privateDnsZoneResourceId: avmPrivateDnsZones[dnsZoneIndex.keyVault]!.outputs.resourceId }]
1931+
}
1932+
service: 'vault'
1933+
subnetResourceId: virtualNetwork!.outputs.subnetResourceIds[0]
1934+
}
1935+
]
1936+
: []
1937+
// WAF aligned configuration for Role-based Access Control
1938+
roleAssignments: [
1939+
{
1940+
principalId: userAssignedIdentity.outputs.principalId
1941+
principalType: 'ServicePrincipal'
1942+
roleDefinitionIdOrName: 'Key Vault Administrator'
1943+
}
1944+
]
1945+
secrets: [
1946+
{
1947+
name: 'AzureAISearchAPIKey'
1948+
value: searchService.outputs.primaryKey
1949+
}
1950+
]
1951+
enableTelemetry: enableTelemetry
1952+
}
1953+
}
1954+
18901955
// ============ //
18911956
// Outputs //
18921957
// ============ //
@@ -1948,3 +2013,4 @@ output REASONING_MODEL_NAME string = 'o3'
19482013
output MCP_SERVER_NAME string = 'MACAE MCP Server'
19492014
output MCP_SERVER_DESCRIPTION string = 'MACAE MCP Server Description'
19502015
output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
2016+
output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'

‎infra/modules/aifp-connections.bicep‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,18 @@ param searchServiceResourceId string
44
param searchServiceLocation string
55
param aiFoundryName string
66
param aiFoundryProjectName string
7+
@secure()
8+
param searchApiKey string
79

810
resource aiSearchFoundryConnection 'Microsoft.CognitiveServices/accounts/projects/connections@2025-04-01-preview' = {
911
name: '${aiFoundryName}/${aiFoundryProjectName}/${aifSearchConnectionName}'
1012
properties: {
1113
category: 'CognitiveSearch'
1214
target: 'https://${searchServiceName}.search.windows.net'
13-
authType: 'AAD'
15+
authType: 'ApiKey'
16+
credentials: {
17+
key: searchApiKey
18+
}
1419
isSharedToAll: true
1520
metadata: {
1621
ApiType: 'Azure'

0 commit comments

Comments
 (0)