Skip to content

Commit 33a0937

Browse files
Avijit-MicrosoftAvijit-Microsoft
authored
Merge pull request #429 from microsoft/psl-pk-US-18243
fix: Replace Hardcoded Secrets with Azure Key Vault References
2 parents dc376a9 + dd08fcf commit 33a0937

File tree

3 files changed

+49
-36
lines changed

3 files changed

+49
-36
lines changed

‎infra/deploy_backend_docker.bicep‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,10 @@ param solutionLocation string
88
param appSettings object = {}
99
param appServicePlanId string
1010
@secure()
11-
param azureOpenAIKey string
12-
@secure()
13-
param azureAiProjectConnString string
14-
@secure()
15-
param azureSearchAdminKey string
11+
param azureAiProjectConnString string
1612
param userassignedIdentityId string
1713
param aiProjectName string
14+
param keyVaultName string
1815

1916
var imageName = 'DOCKER|kmcontainerreg.azurecr.io/km-api:${imageTag}'
2017
//var name = '${solutionName}-api'
@@ -93,9 +90,7 @@ module appService 'deploy_app_service.bicep' = {
9390
userassignedIdentityId:userassignedIdentityId
9491
appSettings: union(
9592
appSettings,
96-
{
97-
AZURE_OPENAI_API_KEY: azureOpenAIKey
98-
AZURE_AI_SEARCH_API_KEY: azureSearchAdminKey
93+
{
9994
AZURE_AI_PROJECT_CONN_STRING:azureAiProjectConnString
10095
APPINSIGHTS_INSTRUMENTATIONKEY: reference(applicationInsightsId, '2015-05-01').InstrumentationKey
10196
REACT_APP_LAYOUT_CONFIG: reactAppLayoutConfig
@@ -140,6 +135,23 @@ resource aiDeveloperAccessProj 'Microsoft.Authorization/roleAssignments@2022-04-
140135
}
141136
}
142137

138+
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
139+
name: keyVaultName
140+
}
141+
142+
resource keyVaultSecretsUser 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
143+
name: '4633458b-17de-408a-b874-0445c86b69e6'
144+
}
145+
146+
resource keyVaultSecretsUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
147+
name: guid(appService.name, keyVault.name, keyVaultSecretsUser.id)
148+
scope: keyVault
149+
properties: {
150+
roleDefinitionId: keyVaultSecretsUser.id
151+
principalId: appService.outputs.identityPrincipalId
152+
}
153+
}
154+
143155
output appUrl string = appService.outputs.appUrl
144156
output reactAppLayoutConfig string = reactAppLayoutConfig
145157
output appInsightInstrumentationKey string = reference(applicationInsightsId, '2015-05-01').InstrumentationKey

‎infra/main.bicep‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -196,16 +196,16 @@ module backend_docker 'deploy_backend_docker.bicep' = {
196196
imageTag: imageTag
197197
appServicePlanId: hostingplan.outputs.name
198198
applicationInsightsId: aifoundry.outputs.applicationInsightsId
199-
azureOpenAIKey:keyVault.getSecret('AZURE-OPENAI-KEY')
200-
azureAiProjectConnString:keyVault.getSecret('AZURE-AI-PROJECT-CONN-STRING')
201-
azureSearchAdminKey:keyVault.getSecret('AZURE-SEARCH-KEY')
199+
azureAiProjectConnString: keyVault.getSecret('AZURE-AI-PROJECT-CONN-STRING')
202200
userassignedIdentityId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.id
203201
aiProjectName: aifoundry.outputs.aiProjectName
202+
keyVaultName: kvault.outputs.keyvaultName
204203
appSettings: {
205204
AZURE_OPEN_AI_DEPLOYMENT_MODEL: gptModelName
206205
AZURE_OPEN_AI_ENDPOINT: aifoundry.outputs.aiServicesTarget
207206
AZURE_OPENAI_API_VERSION: azureOpenAIApiVersion
208207
AZURE_OPENAI_RESOURCE: aifoundry.outputs.aiServicesName
208+
AZURE_OPENAI_API_KEY: '@Microsoft.KeyVault(SecretUri=${kvault.outputs.keyvaultUri}secrets/AZURE-OPENAI-KEY/)'
209209
USE_CHAT_HISTORY_ENABLED: 'True'
210210
AZURE_COSMOSDB_ACCOUNT: cosmosDBModule.outputs.cosmosAccountName
211211
AZURE_COSMOSDB_CONVERSATIONS_CONTAINER: cosmosDBModule.outputs.cosmosContainerName
@@ -218,6 +218,7 @@ module backend_docker 'deploy_backend_docker.bicep' = {
218218

219219
OPENAI_API_VERSION: azureOpenAIApiVersion
220220
AZURE_AI_SEARCH_ENDPOINT: aifoundry.outputs.aiSearchTarget
221+
AZURE_AI_SEARCH_API_KEY: '@Microsoft.KeyVault(SecretUri=${kvault.outputs.keyvaultUri}secrets/AZURE-SEARCH-KEY/)'
221222
AZURE_AI_SEARCH_INDEX: 'call_transcripts_index'
222223
USE_AI_PROJECT_CLIENT: 'False'
223224
DISPLAY_CHART_DEFAULT: 'False'

‎infra/main.json‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.35.1.17967",
8-
"templateHash": "11070314243723624529"
8+
"templateHash": "10142662026066718684"
99
}
1010
},
1111
"parameters": {
@@ -2406,14 +2406,6 @@
24062406
"applicationInsightsId": {
24072407
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.applicationInsightsId.value]"
24082408
},
2409-
"azureOpenAIKey": {
2410-
"reference": {
2411-
"keyVault": {
2412-
"id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.KeyVault/vaults', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.keyvaultName.value)]"
2413-
},
2414-
"secretName": "AZURE-OPENAI-KEY"
2415-
}
2416-
},
24172409
"azureAiProjectConnString": {
24182410
"reference": {
24192411
"keyVault": {
@@ -2422,26 +2414,22 @@
24222414
"secretName": "AZURE-AI-PROJECT-CONN-STRING"
24232415
}
24242416
},
2425-
"azureSearchAdminKey": {
2426-
"reference": {
2427-
"keyVault": {
2428-
"id": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.KeyVault/vaults', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.keyvaultName.value)]"
2429-
},
2430-
"secretName": "AZURE-SEARCH-KEY"
2431-
}
2432-
},
24332417
"userassignedIdentityId": {
24342418
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityBackendAppOutput.value.id]"
24352419
},
24362420
"aiProjectName": {
24372421
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.aiProjectName.value]"
24382422
},
2423+
"keyVaultName": {
2424+
"value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_keyvault'), '2022-09-01').outputs.keyvaultName.value]"
2425+
},
24392426
"appSettings": {
24402427
"value": {
24412428
"AZURE_OPEN_AI_DEPLOYMENT_MODEL": "[parameters('gptModelName')]",
24422429
"AZURE_OPEN_AI_ENDPOINT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.aiServicesTarget.value]",
24432430
"AZURE_OPENAI_API_VERSION": "[variables('azureOpenAIApiVersion')]",
24442431
"AZURE_OPENAI_RESOURCE": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.aiServicesName.value]",
2432+
"AZURE_OPENAI_API_KEY": "[format('@Microsoft.KeyVault(SecretUri={0}secrets/AZURE-OPENAI-KEY/)', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_keyvault'), '2022-09-01').outputs.keyvaultUri.value)]",
24452433
"USE_CHAT_HISTORY_ENABLED": "True",
24462434
"AZURE_COSMOSDB_ACCOUNT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_cosmos_db'), '2022-09-01').outputs.cosmosAccountName.value]",
24472435
"AZURE_COSMOSDB_CONVERSATIONS_CONTAINER": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_cosmos_db'), '2022-09-01').outputs.cosmosContainerName.value]",
@@ -2453,6 +2441,7 @@
24532441
"SQLDB_USER_MID": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityBackendAppOutput.value.clientId]",
24542442
"OPENAI_API_VERSION": "[variables('azureOpenAIApiVersion')]",
24552443
"AZURE_AI_SEARCH_ENDPOINT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.aiSearchTarget.value]",
2444+
"AZURE_AI_SEARCH_API_KEY": "[format('@Microsoft.KeyVault(SecretUri={0}secrets/AZURE-SEARCH-KEY/)', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_keyvault'), '2022-09-01').outputs.keyvaultUri.value)]",
24562445
"AZURE_AI_SEARCH_INDEX": "call_transcripts_index",
24572446
"USE_AI_PROJECT_CLIENT": "False",
24582447
"DISPLAY_CHART_DEFAULT": "False"
@@ -2466,7 +2455,7 @@
24662455
"_generator": {
24672456
"name": "bicep",
24682457
"version": "0.35.1.17967",
2469-
"templateHash": "9270015503157482424"
2458+
"templateHash": "910344753923922220"
24702459
}
24712460
},
24722461
"parameters": {
@@ -2489,21 +2478,18 @@
24892478
"appServicePlanId": {
24902479
"type": "string"
24912480
},
2492-
"azureOpenAIKey": {
2493-
"type": "securestring"
2494-
},
24952481
"azureAiProjectConnString": {
24962482
"type": "securestring"
24972483
},
2498-
"azureSearchAdminKey": {
2499-
"type": "securestring"
2500-
},
25012484
"userassignedIdentityId": {
25022485
"type": "string"
25032486
},
25042487
"aiProjectName": {
25052488
"type": "string"
25062489
},
2490+
"keyVaultName": {
2491+
"type": "string"
2492+
},
25072493
"name": {
25082494
"type": "string"
25092495
}
@@ -2539,6 +2525,19 @@
25392525
"[resourceId('Microsoft.Resources/deployments', format('{0}-app-module', parameters('name')))]"
25402526
]
25412527
},
2528+
{
2529+
"type": "Microsoft.Authorization/roleAssignments",
2530+
"apiVersion": "2022-04-01",
2531+
"scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
2532+
"name": "[guid(format('{0}-app-module', parameters('name')), parameters('keyVaultName'), resourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6'))]",
2533+
"properties": {
2534+
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
2535+
"principalId": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-app-module', parameters('name'))), '2022-09-01').outputs.identityPrincipalId.value]"
2536+
},
2537+
"dependsOn": [
2538+
"[resourceId('Microsoft.Resources/deployments', format('{0}-app-module', parameters('name')))]"
2539+
]
2540+
},
25422541
{
25432542
"type": "Microsoft.Resources/deployments",
25442543
"apiVersion": "2022-09-01",
@@ -2565,7 +2564,7 @@
25652564
"value": "[parameters('userassignedIdentityId')]"
25662565
},
25672566
"appSettings": {
2568-
"value": "[union(parameters('appSettings'), createObject('AZURE_OPENAI_API_KEY', parameters('azureOpenAIKey'), 'AZURE_AI_SEARCH_API_KEY', parameters('azureSearchAdminKey'), 'AZURE_AI_PROJECT_CONN_STRING', parameters('azureAiProjectConnString'), 'APPINSIGHTS_INSTRUMENTATIONKEY', reference(parameters('applicationInsightsId'), '2015-05-01').InstrumentationKey, 'REACT_APP_LAYOUT_CONFIG', variables('reactAppLayoutConfig')))]"
2567+
"value": "[union(parameters('appSettings'), createObject('AZURE_AI_PROJECT_CONN_STRING', parameters('azureAiProjectConnString'), 'APPINSIGHTS_INSTRUMENTATIONKEY', reference(parameters('applicationInsightsId'), '2015-05-01').InstrumentationKey, 'REACT_APP_LAYOUT_CONFIG', variables('reactAppLayoutConfig')))]"
25692568
}
25702569
},
25712570
"template": {
@@ -2764,6 +2763,7 @@
27642763
"[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry')]",
27652764
"[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_cosmos_db')]",
27662765
"[resourceId('Microsoft.Resources/deployments', 'deploy_app_service_plan')]",
2766+
"[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_keyvault')]",
27672767
"[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]",
27682768
"[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_sql_db')]"
27692769
]

0 commit comments

Comments
 (0)