Skip to content

Commit bd9681b

Browse files
Pavan-MicrosoftPavan-Microsoft
committed
Fix deployment error
1 parent 4d0b6b0 commit bd9681b

File tree

3 files changed

+55
-44
lines changed

3 files changed

+55
-44
lines changed

‎infra/deploy_ai_foundry.bicep‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -250,18 +250,18 @@ module assignFoundryRoleToMIExisting 'deploy_foundry_role_assignment.bicep' = if
250250
params: {
251251
roleDefinitionId: aiUser.id
252252
roleAssignmentName: guid(resourceGroup().id, managedIdentityObjectId, aiUser.id, 'foundry')
253-
aiServicesName: !empty(azureExistingAIProjectResourceId) ? existingAIServicesName : aiServicesName
254-
aiProjectName: !empty(azureExistingAIProjectResourceId) ? existingAIProjectName : aiProjectName
253+
aiServicesName: existingAIServicesName
254+
aiProjectName: existingAIProjectName
255255
principalId: managedIdentityObjectId
256-
// Use the existing AI project resource ID to determine the location and other properties
257-
aiLocation: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.location : solutionLocation
258-
aiKind: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.kind : 'AIServices'
259-
aiSkuName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.skuName : 'S0'
260-
customSubDomainName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.customSubDomainName : aiServicesName
261-
publicNetworkAccess: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.publicNetworkAccess : 'Enabled'
262-
defaultNetworkAction: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.defaultNetworkAction : 'Allow'
263-
vnetRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.vnetRules : []
264-
ipRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.ipRules : []
256+
aiLocation: existing_aiServicesModule.outputs.location
257+
aiKind: existing_aiServicesModule.outputs.kind
258+
aiSkuName: existing_aiServicesModule.outputs.skuName
259+
customSubDomainName: existing_aiServicesModule.outputs.customSubDomainName
260+
publicNetworkAccess: existing_aiServicesModule.outputs.publicNetworkAccess
261+
enableSystemAssignedIdentity: true
262+
defaultNetworkAction: existing_aiServicesModule.outputs.defaultNetworkAction
263+
vnetRules: existing_aiServicesModule.outputs.vnetRules
264+
ipRules: existing_aiServicesModule.outputs.ipRules
265265
aiModelDeployments: aiModelDeployments // Pass the model deployments to the module if model not already deployed
266266
}
267267
}
@@ -280,28 +280,27 @@ resource cognitiveServicesOpenAIUser 'Microsoft.Authorization/roleDefinitions@20
280280
name: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
281281
}
282282

283-
module assignOpenAIRoleToAISearch 'deploy_foundry_role_assignment.bicep' = {
284-
name: 'assignOpenAIRoleToAISearch'
283+
resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (empty(azureExistingAIProjectResourceId)) {
284+
name: guid(resourceGroup().id, aiServices.id, cognitiveServicesOpenAIUser.id)
285+
scope: aiServices
286+
properties: {
287+
principalId: aiSearch.identity.principalId
288+
roleDefinitionId: cognitiveServicesOpenAIUser.id
289+
principalType: 'ServicePrincipal'
290+
}
291+
}
292+
293+
module assignOpenAIRoleToAISearchExisting 'deploy_foundry_role_assignment.bicep' = if (!empty(azureExistingAIProjectResourceId)) {
294+
name: 'assignOpenAIRoleToAISearchExisting'
285295
scope: resourceGroup(existingAIServiceSubscription, existingAIServiceResourceGroup)
286296
params: {
287297
roleDefinitionId: cognitiveServicesOpenAIUser.id
288298
roleAssignmentName: guid(resourceGroup().id, aiSearch.id, cognitiveServicesOpenAIUser.id, 'openai-foundry')
289-
aiServicesName: !empty(azureExistingAIProjectResourceId) ? existingAIServicesName : aiServicesName
290-
aiProjectName: !empty(azureExistingAIProjectResourceId) ? existingAIProjectName : aiProjectName
299+
aiServicesName: existingAIServicesName
300+
aiProjectName: existingAIProjectName
291301
principalId: aiSearch.identity.principalId
292-
// Use the existing AI project resource ID to determine the location and other properties
293-
aiLocation: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.location : solutionLocation
294-
aiKind: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.kind : 'AIServices'
295-
aiSkuName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.skuName : 'S0'
296-
customSubDomainName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.customSubDomainName : aiServicesName
297-
publicNetworkAccess: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.publicNetworkAccess : 'Enabled'
298-
defaultNetworkAction: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.defaultNetworkAction : 'Allow'
299-
vnetRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.vnetRules : []
300-
ipRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.ipRules : []
302+
enableSystemAssignedIdentity: false
301303
}
302-
dependsOn: [
303-
assignFoundryRoleToMIExisting
304-
]
305304
}
306305

307306
resource searchIndexDataReader 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
@@ -322,7 +321,7 @@ resource assignSearchIndexDataReaderToExistingAiProject 'Microsoft.Authorization
322321
name: guid(resourceGroup().id, existingAIProjectName, searchIndexDataReader.id, 'Existing')
323322
scope: aiSearch
324323
properties: {
325-
principalId: assignOpenAIRoleToAISearch.outputs.aiProjectPrincipalId
324+
principalId: assignOpenAIRoleToAISearchExisting.outputs.aiProjectPrincipalId
326325
roleDefinitionId: searchIndexDataReader.id
327326
principalType: 'ServicePrincipal'
328327
}
@@ -346,7 +345,7 @@ resource assignSearchServiceContributorToExistingAiProject 'Microsoft.Authorizat
346345
name: guid(resourceGroup().id, existingAIProjectName, searchServiceContributor.id, 'Existing')
347346
scope: aiSearch
348347
properties: {
349-
principalId: assignOpenAIRoleToAISearch.outputs.aiProjectPrincipalId
348+
principalId: assignOpenAIRoleToAISearchExisting.outputs.aiProjectPrincipalId
350349
roleDefinitionId: searchServiceContributor.id
351350
principalType: 'ServicePrincipal'
352351
}

‎infra/deploy_backend_docker.bicep‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -185,14 +185,7 @@ module assignAiUserRoleToAiProject 'deploy_foundry_role_assignment.bicep' = {
185185
roleAssignmentName: guid(appService.name, aiServices.id, aiUser.id)
186186
aiServicesName: !empty(azureExistingAIProjectResourceId) ? existingAIServicesName : aiServicesName
187187
aiProjectName: !empty(azureExistingAIProjectResourceId) ? split(azureExistingAIProjectResourceId, '/')[10] : ''
188-
aiLocation: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.location : aideploymentsLocation
189-
aiKind: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.kind : 'AIServices'
190-
aiSkuName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.skuName : 'S0'
191-
customSubDomainName: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.customSubDomainName : aiServicesName
192-
publicNetworkAccess: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.publicNetworkAccess : 'Enabled'
193-
defaultNetworkAction: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.defaultNetworkAction : 'Allow'
194-
vnetRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.vnetRules : []
195-
ipRules: !empty(azureExistingAIProjectResourceId) ? existing_aiServicesModule.outputs.ipRules : []
188+
enableSystemAssignedIdentity: false
196189
}
197190
}
198191

‎infra/deploy_foundry_role_assignment.bicep‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,19 @@ param aiProjectName string = ''
66
param aiLocation string=''
77
param aiKind string=''
88
param aiSkuName string=''
9+
param enableSystemAssignedIdentity bool = false
910
param customSubDomainName string = ''
1011
param publicNetworkAccess string = ''
11-
param defaultNetworkAction string
12+
param defaultNetworkAction string = ''
1213
param vnetRules array = []
1314
param ipRules array = []
1415
param aiModelDeployments array = []
1516

16-
resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {
17+
resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' existing = if (!enableSystemAssignedIdentity) {
18+
name: aiServicesName
19+
}
20+
21+
resource aiServicesWithIdentity 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if (enableSystemAssignedIdentity) {
1722
name: aiServicesName
1823
location: aiLocation
1924
kind: aiKind
@@ -38,7 +43,7 @@ resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' =
3843

3944
@batchSize(1)
4045
resource aiServicesDeployments 'Microsoft.CognitiveServices/accounts/deployments@2025-04-01-preview' = [for aiModeldeployment in aiModelDeployments: if (!empty(aiModelDeployments)) {
41-
parent: aiServices
46+
parent: aiServicesWithIdentity
4247
name: aiModeldeployment.name
4348
properties: {
4449
model: {
@@ -53,9 +58,14 @@ resource aiServicesDeployments 'Microsoft.CognitiveServices/accounts/deployments
5358
}
5459
}]
5560

56-
resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' = if (!empty(aiProjectName)) {
61+
resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' existing = if (!empty(aiProjectName) && !enableSystemAssignedIdentity) {
5762
name: aiProjectName
5863
parent: aiServices
64+
}
65+
66+
resource aiProjectWithIdentity 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' = if (!empty(aiProjectName) && enableSystemAssignedIdentity) {
67+
name: aiProjectName
68+
parent: aiServicesWithIdentity
5969
location: aiLocation
6070
identity: {
6171
type: 'SystemAssigned'
@@ -64,7 +74,16 @@ resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-pre
6474
}
6575

6676
// Role Assignment to AI Services
67-
resource roleAssignmentToFoundry 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
77+
resource roleAssignmentToFoundryExisting 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableSystemAssignedIdentity) {
78+
name: roleAssignmentName
79+
scope: aiServicesWithIdentity
80+
properties: {
81+
roleDefinitionId: roleDefinitionId
82+
principalId: principalId
83+
}
84+
}
85+
86+
resource roleAssignmentToFoundry 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!enableSystemAssignedIdentity) {
6887
name: roleAssignmentName
6988
scope: aiServices
7089
properties: {
@@ -74,5 +93,5 @@ resource roleAssignmentToFoundry 'Microsoft.Authorization/roleAssignments@2022-0
7493
}
7594

7695
// Outputs
77-
output aiServicesPrincipalId string = aiServices.identity.principalId
78-
output aiProjectPrincipalId string = !empty(aiProjectName) ? aiProject.identity.principalId : ''
96+
output aiServicesPrincipalId string = enableSystemAssignedIdentity ? aiServicesWithIdentity.identity.principalId : aiServices.identity.principalId
97+
output aiProjectPrincipalId string = !empty(aiProjectName) && enableSystemAssignedIdentity ? aiProjectWithIdentity.identity.principalId : aiProject.identity.principalId

0 commit comments

Comments
 (0)