Refactor Bicep files for improved readability and compliance with Azure policies (TLS1.2 support for SQL) and increased quota for Azure AI Foundry GPT-4o deployment to avoid time outs.

Author: oliverlabs

infra/deploy_sql_db.bicep

@@ -7,28 +7,29 @@ param keyVaultName string
 param managedIdentityObjectId string
 param managedIdentityName string
 
-var serverName = '${ solutionName }-sql-server'
-var sqlDBName = '${ solutionName }-sql-db'
+var serverName = '${solutionName }-sql-server'
+var sqlDBName = '${solutionName }-sql-db'
 var location = solutionLocation
 var administratorLogin = 'sqladmin'
 var administratorLoginPassword = 'TestPassword_1234'
 
 resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
   name: serverName
   location: location
-  kind:'v12.0'
+  kind: 'v12.0'
   properties: {
-      publicNetworkAccess: 'Enabled'
-      version: '12.0'
-      restrictOutboundNetworkAccess: 'Disabled'
-      administrators: {
-        login: managedIdentityName
-        sid: managedIdentityObjectId
-        tenantId: subscription().tenantId
-        administratorType: 'ActiveDirectory'
-        azureADOnlyAuthentication: true
-      }
+    publicNetworkAccess: 'Enabled'
+    version: '12.0'
+    restrictOutboundNetworkAccess: 'Disabled'
+    minimalTlsVersion: '1.2' // Enforce TLS 1.2 to comply with Azure policy
+    administrators: {
+      login: managedIdentityName
+      sid: managedIdentityObjectId
+      tenantId: subscription().tenantId
+      administratorType: 'ActiveDirectory'
+      azureADOnlyAuthentication: true
     }
+  }
 }
 
 resource firewallRule 'Microsoft.Sql/servers/firewallRules@2023-08-01-preview' = {
@@ -59,11 +60,11 @@ resource sqlDB 'Microsoft.Sql/servers/databases@2023-08-01-preview' = {
     family: 'Gen5'
     capacity: 2
   }
-  kind:'v12.0,user,vcore,serverless'
+  kind: 'v12.0,user,vcore,serverless'
   properties: {
     collation: 'SQL_Latin1_General_CP1_CI_AS'
-    autoPauseDelay:60
-    minCapacity:1
+    autoPauseDelay: 60
+    minCapacity: 1
     readScale: 'Disabled'
     zoneRedundant: false
   }
@@ -77,7 +78,7 @@ resource sqldbServerEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview'
   parent: keyVault
   name: 'SQLDB-SERVER'
   properties: {
-    value: '${serverName}.database.windows.net'
+    value: '${serverName}${environment().suffixes.sqlServerHostname}'
   }
 }
 

infra/main.bicep

@@ -8,10 +8,7 @@ param environmentName string
 
 @minLength(1)
 @description('Location for the Content Understanding service deployment:')
-@allowed(['swedencentral' 
-'australiaeast'
-])
-
+@allowed(['swedencentral', 'australiaeast'])
 @metadata({
   azd: {
     type: 'location'
@@ -49,7 +46,7 @@ var azureOpenAIApiVersion = '2024-02-15-preview'
 @description('Capacity of the GPT deployment:')
 // You can increase this, but capacity is limited per model/region, so you will get errors if you go over
 // https://learn.microsoft.com/en-us/azure/ai-services/openai/quotas-limits
-param gptDeploymentCapacity int = 30
+param gptDeploymentCapacity int = 653
 
 @minLength(1)
 @description('Name of the Text Embedding model to deploy:')
@@ -58,7 +55,6 @@ param gptDeploymentCapacity int = 30
 ])
 param embeddingModel string = 'text-embedding-ada-002'
 
-
 @minValue(10)
 @description('Capacity of the Embedding Model deployment')
 param embeddingDeploymentCapacity int = 80
@@ -73,7 +69,6 @@ var resourceGroupLocation = resourceGroup().location
 var solutionLocation = resourceGroupLocation
 var baseUrl = 'https://raw.githubusercontent.com/microsoft/Conversation-Knowledge-Mining-Solution-Accelerator/main/'
 
-
 // ========== Managed Identity ========== //
 module managedIdentityModule 'deploy_managed_identity.bicep' = {
   name: 'deploy_managed_identity'
@@ -90,7 +85,7 @@ module kvault 'deploy_keyvault.bicep' = {
   params: {
     solutionName: solutionPrefix
     solutionLocation: resourceGroupLocation
-    managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.objectId
+    managedIdentityObjectId: managedIdentityModule.outputs.managedIdentityOutput.objectId
   }
   scope: resourceGroup(resourceGroup().name)
 }
@@ -109,7 +104,7 @@ module aifoundry 'deploy_ai_foundry.bicep' = {
     gptDeploymentCapacity: gptDeploymentCapacity
     embeddingModel: embeddingModel
     embeddingDeploymentCapacity: embeddingDeploymentCapacity
-    managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.objectId
+    managedIdentityObjectId: managedIdentityModule.outputs.managedIdentityOutput.objectId
   }
   scope: resourceGroup(resourceGroup().name)
 }
@@ -121,7 +116,7 @@ module storageAccount 'deploy_storage_account.bicep' = {
     solutionName: solutionPrefix
     solutionLocation: solutionLocation
     keyVaultName: kvault.outputs.keyvaultName
-    managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.objectId
+    managedIdentityObjectId: managedIdentityModule.outputs.managedIdentityOutput.objectId
   }
   scope: resourceGroup(resourceGroup().name)
 }
@@ -158,23 +153,23 @@ resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
 
 //========== Deployment script to upload sample data ========== //
 module uploadFiles 'deploy_post_deployment_scripts.bicep' = {
-  name : 'deploy_post_deployment_scripts'
-  params:{
+  name: 'deploy_post_deployment_scripts'
+  params: {
     solutionName: solutionPrefix
     solutionLocation: secondaryLocation
     baseUrl: baseUrl
     storageAccountName: storageAccount.outputs.storageName
     containerName: storageAccount.outputs.storageContainer
-    managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.id
-    managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
-    keyVaultName:aifoundry.outputs.keyvaultName
+    managedIdentityObjectId: managedIdentityModule.outputs.managedIdentityOutput.id
+    managedIdentityClientId: managedIdentityModule.outputs.managedIdentityOutput.clientId
+    keyVaultName: aifoundry.outputs.keyvaultName
     logAnalyticsWorkspaceResourceName: aifoundry.outputs.logAnalyticsWorkspaceResourceName
     sqlServerName: sqlDBModule.outputs.sqlServerName
     sqlDbName: sqlDBModule.outputs.sqlDbName
     sqlUsers: [
       {
-        principalId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId  // Replace with actual Principal ID
-        principalName: managedIdentityModule.outputs.managedIdentityBackendAppOutput.name    // Replace with actual user email or name
+        principalId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId // Replace with actual Principal ID
+        principalName: managedIdentityModule.outputs.managedIdentityBackendAppOutput.name // Replace with actual user email or name
         databaseRoles: ['db_datareader', 'db_datawriter']
       }
     ]
@@ -188,52 +183,52 @@ module hostingplan 'deploy_app_service_plan.bicep' = {
   }
 }
 
-module backend_docker 'deploy_backend_docker.bicep'= {
+module backend_docker 'deploy_backend_docker.bicep' = {
   name: 'deploy_backend_docker'
   params: {
     imageTag: imageTag
     appServicePlanId: hostingplan.outputs.name
     applicationInsightsId: aifoundry.outputs.applicationInsightsId
-    azureOpenAIKey:keyVault.getSecret('AZURE-OPENAI-KEY')
-    azureAiProjectConnString:keyVault.getSecret('AZURE-AI-PROJECT-CONN-STRING')
-    azureSearchAdminKey:keyVault.getSecret('AZURE-SEARCH-KEY')
+    azureOpenAIKey: keyVault.getSecret('AZURE-OPENAI-KEY')
+    azureAiProjectConnString: keyVault.getSecret('AZURE-AI-PROJECT-CONN-STRING')
+    azureSearchAdminKey: keyVault.getSecret('AZURE-SEARCH-KEY')
     solutionName: solutionPrefix
     userassignedIdentityId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.id
     aiProjectName: aifoundry.outputs.aiProjectName
-    appSettings:{
-        AZURE_OPEN_AI_DEPLOYMENT_MODEL:gptModelName
-        AZURE_OPEN_AI_ENDPOINT:aifoundry.outputs.aiServicesTarget
-        AZURE_OPENAI_API_VERSION: azureOpenAIApiVersion
-        AZURE_OPENAI_RESOURCE:aifoundry.outputs.aiServicesName
-        USE_CHAT_HISTORY_ENABLED:'True'
-        AZURE_COSMOSDB_ACCOUNT: cosmosDBModule.outputs.cosmosAccountName
-        AZURE_COSMOSDB_CONVERSATIONS_CONTAINER: cosmosDBModule.outputs.cosmosContainerName
-        AZURE_COSMOSDB_DATABASE: cosmosDBModule.outputs.cosmosDatabaseName
-        AZURE_COSMOSDB_ENABLE_FEEDBACK:'True'
-        SQLDB_DATABASE:sqlDBModule.outputs.sqlDbName
-        SQLDB_SERVER: sqlDBModule.outputs.sqlServerName
-        SQLDB_USERNAME: sqlDBModule.outputs.sqlDbUser
-        SQLDB_USER_MID: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId
+    appSettings: {
+      AZURE_OPEN_AI_DEPLOYMENT_MODEL: gptModelName
+      AZURE_OPEN_AI_ENDPOINT: aifoundry.outputs.aiServicesTarget
+      AZURE_OPENAI_API_VERSION: azureOpenAIApiVersion
+      AZURE_OPENAI_RESOURCE: aifoundry.outputs.aiServicesName
+      USE_CHAT_HISTORY_ENABLED: 'True'
+      AZURE_COSMOSDB_ACCOUNT: cosmosDBModule.outputs.cosmosAccountName
+      AZURE_COSMOSDB_CONVERSATIONS_CONTAINER: cosmosDBModule.outputs.cosmosContainerName
+      AZURE_COSMOSDB_DATABASE: cosmosDBModule.outputs.cosmosDatabaseName
+      AZURE_COSMOSDB_ENABLE_FEEDBACK: 'True'
+      SQLDB_DATABASE: sqlDBModule.outputs.sqlDbName
+      SQLDB_SERVER: sqlDBModule.outputs.sqlServerName
+      SQLDB_USERNAME: sqlDBModule.outputs.sqlDbUser
+      SQLDB_USER_MID: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId
 
-        OPENAI_API_VERSION: azureOpenAIApiVersion
-        AZURE_AI_SEARCH_ENDPOINT: aifoundry.outputs.aiSearchTarget
-        AZURE_AI_SEARCH_INDEX: 'call_transcripts_index'
-        USE_AI_PROJECT_CLIENT:'False'
-        DISPLAY_CHART_DEFAULT:'False'
-      }
+      OPENAI_API_VERSION: azureOpenAIApiVersion
+      AZURE_AI_SEARCH_ENDPOINT: aifoundry.outputs.aiSearchTarget
+      AZURE_AI_SEARCH_INDEX: 'call_transcripts_index'
+      USE_AI_PROJECT_CLIENT: 'False'
+      DISPLAY_CHART_DEFAULT: 'False'
+    }
   }
   scope: resourceGroup(resourceGroup().name)
 }
 
-module frontend_docker 'deploy_frontend_docker.bicep'= {
+module frontend_docker 'deploy_frontend_docker.bicep' = {
   name: 'deploy_frontend_docker'
   params: {
     imageTag: imageTag
     appServicePlanId: hostingplan.outputs.name
     applicationInsightsId: aifoundry.outputs.applicationInsightsId
     solutionName: solutionPrefix
-    appSettings:{
-      APP_API_BASE_URL:backend_docker.outputs.appUrl
+    appSettings: {
+      APP_API_BASE_URL: backend_docker.outputs.appUrl
     }
   }
   scope: resourceGroup(resourceGroup().name)
@@ -276,4 +271,3 @@ output DISPLAY_CHART_DEFAULT string = 'False'
 
 output API_APP_URL string = backend_docker.outputs.appUrl
 output WEB_APP_URL string = frontend_docker.outputs.appUrl
-