Skip to content

Commit f96ec1c

Browse files
Priyanka-MicrosoftPriyanka-Microsoft
committed
process KM sample data manually as part of post-deployment activity
1 parent aed17d1 commit f96ec1c

File tree

8 files changed

+290
-81
lines changed

8 files changed

+290
-81
lines changed

‎infra/scripts/add_user_scripts/create-sql-user-and-role.ps1‎

Lines changed: 28 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
.DESCRIPTION
88
During an application deployment, the managed identity (and potentially the developer identity)
99
must be added to the SQL database as a user and assigned to one or more roles. This script
10-
accomplishes this task using the owner-managed identity for authentication.
10+
accomplishes this task using Azure AD authentication.
1111
1212
.PARAMETER SqlServerName
1313
The name of the Azure SQL Server resource.
@@ -21,43 +21,36 @@
2121
.PARAMETER DisplayName
2222
The Object (Principal) display name of the identity to be added.
2323
24-
.PARAMETER ManagedIdentityClientId
25-
The Client ID of the managed identity that will authenticate to the SQL database.
24+
.PARAMETER UseManagedIdentity
25+
Switch to indicate whether to use a Managed Identity for authentication (useful for automation).
26+
If not provided, it will use your currently logged-in Azure AD account.
2627
2728
.PARAMETER DatabaseRole
2829
The database role that should be assigned to the user (e.g., db_datareader, db_datawriter, db_owner).
2930
#>
3031

31-
Param(
32+
param (
3233
[string] $SqlServerName,
3334
[string] $SqlDatabaseName,
3435
[string] $ClientId,
3536
[string] $DisplayName,
36-
[string] $ManagedIdentityClientId,
37+
[switch] $UseManagedIdentity,
3738
[string] $DatabaseRole
3839
)
3940

4041
function Resolve-Module($moduleName) {
41-
# If module is imported; say that and do nothing
42-
if (Get-Module | Where-Object { $_.Name -eq $moduleName }) {
43-
Write-Debug "Module $moduleName is already imported"
44-
} elseif (Get-Module -ListAvailable | Where-Object { $_.Name -eq $moduleName }) {
45-
Import-Module $moduleName
46-
} elseif (Find-Module -Name $moduleName | Where-Object { $_.Name -eq $moduleName }) {
47-
Install-Module $moduleName -Force -Scope CurrentUser
48-
Import-Module $moduleName
49-
} else {
50-
Write-Error "Module $moduleName not found"
51-
[Environment]::exit(1)
42+
if (-not (Get-Module -ListAvailable -Name $moduleName)) {
43+
Install-Module -Name $moduleName -Scope CurrentUser -Force -AllowClobber
5244
}
45+
Import-Module -Name $moduleName -Force
5346
}
5447

55-
###
56-
### MAIN SCRIPT
57-
###
48+
### Load Required Modules
49+
Resolve-Module -moduleName Az.Accounts
5850
Resolve-Module -moduleName Az.Resources
5951
Resolve-Module -moduleName SqlServer
6052

53+
### Generate SQL Script
6154
$sql = @"
6255
DECLARE @username nvarchar(max) = N'$($DisplayName)';
6356
DECLARE @clientId uniqueidentifier = '$($ClientId)';
@@ -70,8 +63,21 @@ END
7063
EXEC sp_addrolemember '$($DatabaseRole)', @username;
7164
"@
7265

73-
Write-Output "`nSQL:`n$($sql)`n`n"
66+
Write-Output "`nSQL to be executed:`n$($sql)`n"
67+
68+
### Authenticate and Get Access Token
69+
if ($UseManagedIdentity) {
70+
Write-Host "[INFO] Logging in using Managed Identity..."
71+
Connect-AzAccount -Identity
72+
} else {
73+
Write-Host "[INFO] Logging in using current user identity..."
74+
Connect-AzAccount
75+
}
7476

75-
Connect-AzAccount -Identity -AccountId $ManagedIdentityClientId
7677
$token = (Get-AzAccessToken -ResourceUrl https://database.windows.net/).Token
77-
Invoke-SqlCmd -ServerInstance "$SqlServerName" -Database $SqlDatabaseName -AccessToken $token -Query $sql -ErrorAction 'Stop'
78+
79+
### Execute the SQL Command
80+
Write-Host "[INFO] Executing SQL against $SqlDatabaseName..."
81+
Invoke-Sqlcmd -ServerInstance "$SqlServerName.database.windows.net" -Database $SqlDatabaseName -AccessToken $token -Query $sql -ErrorAction Stop
82+
83+
Write-Host "[SUCCESS] User and role assignment completed."

‎infra/scripts/copy_kb_files.sh‎

Lines changed: 56 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,71 @@
33
# Variables
44
storageAccount="$1"
55
fileSystem="$2"
6-
baseUrl="$3"
6+
# baseUrl="$3"
77
managedIdentityClientId="$4"
8+
keyVaultName="$5" # ✅ NEW ARG REQUIRED
89

910
zipFileName1="call_transcripts.zip"
1011
extractedFolder1="call_transcripts"
11-
zipUrl1=${baseUrl}"infra/data/call_transcripts.zip"
12+
zipUrl1="infra/data/call_transcripts.zip"
1213

1314
zipFileName2="audio_data.zip"
1415
extractedFolder2="audiodata"
15-
zipUrl2=${baseUrl}"infra/data/audio_data.zip"
16+
zipUrl2="infra/data/audio_data.zip"
1617

17-
# Create folders if they do not exist
18-
mkdir -p "/mnt/azscripts/azscriptinput/$extractedFolder1"
19-
mkdir -p "/mnt/azscripts/azscriptinput/$extractedFolder2"
18+
unzip infra/data/"$zipFileName1" -d infra/data/"$extractedFolder1"
19+
unzip infra/data/"$zipFileName2" -d infra/data/"$extractedFolder2"
2020

21-
# Download the zip file
22-
curl --output /mnt/azscripts/azscriptinput/"$zipFileName1" "$zipUrl1"
23-
curl --output /mnt/azscripts/azscriptinput/"$zipFileName2" "$zipUrl2"
21+
echo "Script Started"
2422

25-
# Extract the zip file
26-
unzip /mnt/azscripts/azscriptinput/"$zipFileName1" -d /mnt/azscripts/azscriptinput/"$extractedFolder1"
27-
unzip /mnt/azscripts/azscriptinput/"$zipFileName2" -d /mnt/azscripts/azscriptinput/"$extractedFolder2"
23+
# Authenticate with Azure
24+
if az account show &> /dev/null; then
25+
echo "Already authenticated with Azure."
26+
else
27+
if [ -n "$managedIdentityClientId" ]; then
28+
echo "Authenticating with Managed Identity..."
29+
az login --identity --client-id ${managedIdentityClientId}
30+
else
31+
echo "Authenticating with Azure CLI..."
32+
az login
33+
fi
34+
echo "Not authenticated with Azure. Attempting to authenticate..."
35+
fi
2836

29-
echo "Script Started"
37+
echo "Getting signed in user id"
38+
signed_user_id=$(az ad signed-in-user show --query id -o tsv)
39+
40+
echo "Getting storage account resource id"
41+
storage_account_resource_id=$(az storage account show --name $storageAccount --query id --output tsv)
42+
43+
# ✅ Assign Storage Blob Data Contributor role (if not already assigned)
44+
echo "Checking if user has the Storage Blob Data Contributor role"
45+
storage_role_assignment=$(az role assignment list --assignee $signed_user_id --role "Storage Blob Data Contributor" --scope $storage_account_resource_id --query "[].roleDefinitionId" -o tsv)
46+
47+
if [ -z "$storage_role_assignment" ]; then
48+
echo "Assigning Storage Blob Data Contributor role..."
49+
az role assignment create --assignee $signed_user_id --role "Storage Blob Data Contributor" --scope $storage_account_resource_id --output none
50+
echo "Role assignment for Blob Storage completed."
51+
else
52+
echo "User already has Storage Blob Data Contributor role."
53+
fi
54+
55+
# ✅ Assign Key Vault Secrets User role (NEW BLOCK)
56+
echo "Getting Key Vault resource ID"
57+
key_vault_resource_id=$(az keyvault show --name $keyVaultName --query id --output tsv)
58+
59+
echo "Checking if user has Key Vault Secrets User role"
60+
kv_role_assignment=$(az role assignment list --assignee $signed_user_id --role "Key Vault Secrets User" --scope $key_vault_resource_id --query "[].roleDefinitionId" -o tsv)
61+
62+
if [ -z "$kv_role_assignment" ]; then
63+
echo "Assigning Key Vault Secrets User role..."
64+
az role assignment create --assignee $signed_user_id --role "Key Vault Secrets User" --scope $key_vault_resource_id --output none
65+
echo "Role assignment for Key Vault completed."
66+
else
67+
echo "User already has Key Vault Secrets User role."
68+
fi
3069

31-
# Authenticate with Azure using managed identity
32-
az login --identity --client-id ${managedIdentityClientId}
33-
# Using az storage blob upload-batch to upload files with managed identity authentication, as the az storage fs directory upload command is not working with managed identity authentication.
34-
az storage blob upload-batch --account-name "$storageAccount" --destination data/"$extractedFolder1" --source /mnt/azscripts/azscriptinput/"$extractedFolder1" --auth-mode login --pattern '*' --overwrite
35-
az storage blob upload-batch --account-name "$storageAccount" --destination data/"$extractedFolder2" --source /mnt/azscripts/azscriptinput/"$extractedFolder2" --auth-mode login --pattern '*' --overwrite
70+
# Upload files to Azure Storage
71+
echo "Uploading files to Azure Storage"
72+
az storage blob upload-batch --account-name "$storageAccount" --destination "$fileSystem"/"$extractedFolder1" --source infra/data/"$extractedFolder1" --auth-mode login --pattern '*' --overwrite --output none
73+
az storage blob upload-batch --account-name "$storageAccount" --destination "$fileSystem"/"$extractedFolder2" --source infra/data/"$extractedFolder2" --auth-mode login --pattern '*' --overwrite --output none

‎infra/scripts/index_scripts/01_create_search_index.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
from azure.keyvault.secrets import SecretClient
22
from azure.identity import DefaultAzureCredential
3+
import sys
34

4-
key_vault_name = 'kv_to-be-replaced'
5-
managed_identity_client_id = 'mici_to-be-replaced'
5+
key_vault_name=sys.argv[1]
6+
managed_identity_client_id = sys.argv[2]
67
index_name = "call_transcripts_index"
78

89
def get_secrets_from_kv(kv_name, secret_name):

‎infra/scripts/index_scripts/02_create_cu_template_audio.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
from pathlib import Path
88
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
99

10-
key_vault_name = 'kv_to-be-replaced'
11-
managed_identity_client_id = 'mici_to-be-replaced'
10+
key_vault_name=sys.argv[1]
11+
managed_identity_client_id = sys.argv[2]
1212

1313
def get_secrets_from_kv(kv_name, secret_name):
1414

‎infra/scripts/index_scripts/02_create_cu_template_text.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
from pathlib import Path
88
from azure.identity import DefaultAzureCredential, get_bearer_token_provider
99

10-
key_vault_name = 'kv_to-be-replaced'
11-
managed_identity_client_id = 'mici_to-be-replaced'
10+
key_vault_name=sys.argv[1]
11+
managed_identity_client_id = sys.argv[2]
1212

1313
def get_secrets_from_kv(kv_name, secret_name):
1414

‎infra/scripts/index_scripts/03_cu_process_data_text.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,10 @@
1313
import base64
1414
import pyodbc
1515
import struct
16+
import sys
1617

17-
key_vault_name = 'kv_to-be-replaced'
18-
managed_identity_client_id = 'mici_to-be-replaced'
18+
key_vault_name=sys.argv[1]
19+
managed_identity_client_id = sys.argv[2]
1920

2021
file_system_client_name = "data"
2122
directory = 'call_transcripts'

‎infra/scripts/process_sample_data.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
3+
set -e # Exit on first error
4+
set -o pipefail
5+
set -u # Treat unset variables as error
6+
7+
# === Configuration Parameters ===
8+
STORAGE_ACCOUNT_NAME="$1"
9+
CONTAINER_NAME="$2"
10+
# BASE_URL="$3"
11+
MANAGED_IDENTITY_CLIENT_ID="$3"
12+
KEY_VAULT_NAME="$4"
13+
SQL_SERVER_NAME="$5"
14+
SQL_DB_NAME="$6"
15+
RG_NAME="$7"
16+
17+
# === Functions ===
18+
log() {
19+
echo -e "\033[1;32m[INFO]\033[0m $1"
20+
}
21+
22+
error() {
23+
echo -e "\033[1;31m[ERROR]\033[0m $1" >&2
24+
exit 1
25+
}
26+
27+
trap 'error "An unexpected error occurred. Please check the logs."' ERR
28+
29+
# basePath="C:/Users/$(whoami)/azscripts/azscriptinput"
30+
# echo "${basePath}"
31+
32+
# === Step 1: Copy KB files ===
33+
echo "Running copy_kb_files.sh"
34+
bash infra/scripts/copy_kb_files.sh "$STORAGE_ACCOUNT_NAME" "$CONTAINER_NAME" "$MANAGED_IDENTITY_CLIENT_ID"
35+
if [ $? -ne 0 ]; then
36+
echo "Error: copy_kb_files.sh failed."
37+
exit 1
38+
fi
39+
echo "copy_kb_files.sh completed successfully."
40+
41+
# === Step 2: Run create index scripts ===
42+
log "Creating indexes..."
43+
echo "Running run_create_index_scripts.sh"
44+
bash infra/scripts/run_create_index_scripts.sh "$KEY_VAULT_NAME" "$MANAGED_IDENTITY_CLIENT_ID" "$SQL_SERVER_NAME" "$RG_NAME"
45+
if [ $? -ne 0 ]; then
46+
echo "Error: run_create_index_scripts.sh failed."
47+
exit 1
48+
fi
49+
echo "run_create_index_scripts.sh completed successfully."
50+
51+
52+
# curl -s -o create-sql-user-and-role.ps1 "${BASE_URL}infra/scripts/add_user_scripts/create-sql-user-and-role.ps1"
53+
# chmod +x create-sql-user-and-role.ps1
54+
55+
# Note: You'll need to pass user info (client ID, display name, role) via environment vars or args.
56+
# Here is a sample with hardcoded values for demo:
57+
58+
# === Step 3: SQL User & Role Setup ===
59+
log "Setting up SQL users and roles..."
60+
61+
pwsh -File ./infra/scripts/add_user_scripts/create-sql-user-and-role.ps1 \
62+
-SqlServerName "$SQL_SERVER_NAME" \
63+
-SqlDatabaseName "$SQL_DB_NAME" \
64+
-ClientId "$MANAGED_IDENTITY_CLIENT_ID" \
65+
-DisplayName "script-user" \
66+
-ManagedIdentityClientId "$MANAGED_IDENTITY_CLIENT_ID" \
67+
-DatabaseRole "db_datawriter" \
68+
69+
log "Sample data processing completed successfully!"

0 commit comments

Comments
 (0)