Skip to content

feat: Add virtual network location parameter for cognitive services #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Vemarthula-Microsoft wants to merge 5 commits into from
Closed

feat: Add virtual network location parameter for cognitive services #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
69d8633
feat: Add virtual network location parameter for cognitive services m…
Vemarthula-Microsoft Dec 3, 2025
36b7816
fix: Remove explicit location parameter and derive from resource grou…
Vemarthula-Microsoft Dec 4, 2025
1ff877c
refactor: Remove virtual network location parameter and compute inter…
Vemarthula-Microsoft Dec 4, 2025
45102e3
feat: Update cognitive services module to accept virtual network loca…
Vemarthula-Microsoft Dec 4, 2025
4ef42f9
refactor: Remove virtual network location parameter and derive from r…
Vemarthula-Microsoft Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 23 additions & 13 deletions infra/modules/cognitive-services/cognitiveServices.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,9 @@ module cognitiveServicesPrivateDnsZone 'br/public:avm/res/network/private-dns-zo
}
}

// Ensure private endpoints are created in the VNet's region
var virtualNetworkLocation = resourceGroup().location

module openAiPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.0' = if (networkIsolation) {
name: 'private-dns-openai-deployment'
params: {
Expand Down Expand Up @@ -116,14 +119,15 @@ module aiServices 'service.bicep' = {
params: {
name: 'cog${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'AIServices'
category: 'AIServices'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
openAiPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
openAiPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId

Expand All @@ -140,12 +144,13 @@ module contentSafety 'service.bicep' = if (contentSafetyEnabled) {
params: {
name: 'safety${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'ContentSafety'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
]: []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -160,13 +165,14 @@ module vision 'service.bicep' = if (visionEnabled) {
params: {
name: 'vision${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'ComputerVision'
sku: 'S1'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -181,13 +187,14 @@ module language 'service.bicep' = if (languageEnabled) {
params: {
name: 'lang${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'TextAnalytics'
sku: 'S'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -202,12 +209,13 @@ module speech 'service.bicep' = if (speechEnabled) {
params: {
name: 'speech${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'SpeechServices'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -222,13 +230,14 @@ module translator 'service.bicep' = if (translatorEnabled) {
params: {
name: 'translator${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'TextTranslation'
sku: 'S1'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -243,6 +252,7 @@ module documentIntelligence 'service.bicep' = if (documentIntelligenceEnabled) {
params: {
name: 'docintel${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'FormRecognizer'
networkIsolation: networkIsolation
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
Expand All @@ -265,9 +275,9 @@ output aiServicesSystemAssignedMIPrincipalId string = aiServices.outputs.?system

output connections array = union(
[aiServices.outputs.foundryConnection],
contentSafetyEnabled ? [contentSafety.outputs.foundryConnection] : [],
visionEnabled ? [vision.outputs.foundryConnection] : [],
languageEnabled ? [language.outputs.foundryConnection] : [],
speechEnabled ? [speech.outputs.foundryConnection] : [],
translatorEnabled ? [translator.outputs.foundryConnection] : [],
documentIntelligenceEnabled ? [documentIntelligence.outputs.foundryConnection] : [])
contentSafetyEnabled ? [contentSafety.outputs.?foundryConnection] : [],
visionEnabled ? [vision.outputs.?foundryConnection] : [],
languageEnabled ? [language.outputs.?foundryConnection] : [],
speechEnabled ? [speech.outputs.?foundryConnection] : [],
translatorEnabled ? [translator.outputs.?foundryConnection] : [],
documentIntelligenceEnabled ? [documentIntelligence.outputs.?foundryConnection] : [])
5 changes: 4 additions & 1 deletion infra/modules/cognitive-services/service.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,8 @@ param privateDnsZonesResourceIds string[] = []

@description('Resource ID of the subnet for the private endpoint.')
param virtualNetworkSubnetResourceId string
@description('Location of the virtual network hosting the private endpoint subnet. Must match the subnet region for private endpoint creation.')
param virtualNetworkLocation string = location

@description('The resource ID of the Log Analytics workspace to use for diagnostic settings.')
param logAnalyticsWorkspaceResourceId string
Expand Down Expand Up @@ -114,7 +116,8 @@ module cognitiveServicePrivateEndpoint 'br/public:avm/res/network/private-endpoi
name: take('pep-${name}-deployment', 64)
params: {
name: 'pep-${nameFormatted}-cognitiveservices'
location: location
// Private endpoint must be in same region as the target subnet/VNet
location: virtualNetworkLocation
tags: tags
privateLinkServiceConnections: [
{
Expand Down