Skip to content

feat: Add virtual network location parameter for cognitive services #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Vemarthula-Microsoft wants to merge 5 commits into from
Closed

feat: Add virtual network location parameter for cognitive services #97

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
69d8633
feat: Add virtual network location parameter for cognitive services m…
Vemarthula-Microsoft Dec 3, 2025
36b7816
fix: Remove explicit location parameter and derive from resource grou…
Vemarthula-Microsoft Dec 4, 2025
1ff877c
refactor: Remove virtual network location parameter and compute inter…
Vemarthula-Microsoft Dec 4, 2025
45102e3
feat: Update cognitive services module to accept virtual network loca…
Vemarthula-Microsoft Dec 4, 2025
4ef42f9
refactor: Remove virtual network location parameter and derive from r…
Vemarthula-Microsoft Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions infra/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,6 +282,7 @@ module cognitiveServices 'modules/cognitive-services/cognitiveServices.bicep' =
name: name
resourceToken: resourceToken
location: aiDeploymentsLocation
virtualNetworkLocation: location
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkResourceId: networkIsolation ? network.outputs.resourceId : ''
Expand Down
35 changes: 22 additions & 13 deletions infra/modules/cognitive-services/cognitiveServices.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ param resourceToken string

@description('Specifies the location for all the Azure resources. Defaults to the location of the resource group.')
param location string
@description('Location of the virtual network (must match VNet region for private endpoints).')
param virtualNetworkLocation string
Copy link
Collaborator

@Prajwal-Microsoft Prajwal-Microsoft Dec 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no need to add this as a parm here, directly pass location to other modules

Copy link
Collaborator

@Prajwal-Microsoft Prajwal-Microsoft Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has to be removed and directly use location


@description('Specifies whether network isolation is enabled. When true, Foundry and related components will be deployed, network access parameters will be set to Disabled.')
param networkIsolation bool
Expand Down Expand Up @@ -116,14 +118,15 @@ module aiServices 'service.bicep' = {
params: {
name: 'cog${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'AIServices'
category: 'AIServices'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
openAiPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
openAiPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId

Expand All @@ -140,12 +143,13 @@ module contentSafety 'service.bicep' = if (contentSafetyEnabled) {
params: {
name: 'safety${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'ContentSafety'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
]: []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -160,13 +164,14 @@ module vision 'service.bicep' = if (visionEnabled) {
params: {
name: 'vision${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'ComputerVision'
sku: 'S1'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -181,13 +186,14 @@ module language 'service.bicep' = if (languageEnabled) {
params: {
name: 'lang${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'TextAnalytics'
sku: 'S'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -202,12 +208,13 @@ module speech 'service.bicep' = if (speechEnabled) {
params: {
name: 'speech${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'SpeechServices'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -222,13 +229,14 @@ module translator 'service.bicep' = if (translatorEnabled) {
params: {
name: 'translator${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'TextTranslation'
sku: 'S1'
networkIsolation: networkIsolation
networkAcls: networkAcls
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
privateDnsZonesResourceIds: networkIsolation ? [
cognitiveServicesPrivateDnsZone.outputs.resourceId
cognitiveServicesPrivateDnsZone.outputs.?resourceId
] : []
logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
roleAssignments: allRoleAssignments
Expand All @@ -243,6 +251,7 @@ module documentIntelligence 'service.bicep' = if (documentIntelligenceEnabled) {
params: {
name: 'docintel${name}${resourceToken}'
location: location
virtualNetworkLocation: virtualNetworkLocation
kind: 'FormRecognizer'
networkIsolation: networkIsolation
virtualNetworkSubnetResourceId: networkIsolation ? virtualNetworkSubnetResourceId : ''
Expand All @@ -265,9 +274,9 @@ output aiServicesSystemAssignedMIPrincipalId string = aiServices.outputs.?system

output connections array = union(
[aiServices.outputs.foundryConnection],
contentSafetyEnabled ? [contentSafety.outputs.foundryConnection] : [],
visionEnabled ? [vision.outputs.foundryConnection] : [],
languageEnabled ? [language.outputs.foundryConnection] : [],
speechEnabled ? [speech.outputs.foundryConnection] : [],
translatorEnabled ? [translator.outputs.foundryConnection] : [],
documentIntelligenceEnabled ? [documentIntelligence.outputs.foundryConnection] : [])
contentSafetyEnabled ? [contentSafety.outputs.?foundryConnection] : [],
visionEnabled ? [vision.outputs.?foundryConnection] : [],
languageEnabled ? [language.outputs.?foundryConnection] : [],
speechEnabled ? [speech.outputs.?foundryConnection] : [],
translatorEnabled ? [translator.outputs.?foundryConnection] : [],
documentIntelligenceEnabled ? [documentIntelligence.outputs.?foundryConnection] : [])
10 changes: 6 additions & 4 deletions infra/modules/cognitive-services/service.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
@description('Name of the Cognitive Services resource. Must be unique in the resource group.')
param name string

@description('The location of the Cognitive Services resource.')
param location string
// Location is derived from the current resource group's region; no explicit param needed.

@description('Required. Kind of the Cognitive Services account. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'SKU\' for your Azure region.')
@allowed([
Expand Down Expand Up @@ -59,6 +58,8 @@ param privateDnsZonesResourceIds string[] = []

@description('Resource ID of the subnet for the private endpoint.')
param virtualNetworkSubnetResourceId string
@description('Location of the virtual network hosting the private endpoint subnet. Must match the subnet region for private endpoint creation.')
param virtualNetworkLocation string = resourceGroup().location

@description('The resource ID of the Log Analytics workspace to use for diagnostic settings.')
param logAnalyticsWorkspaceResourceId string
Expand All @@ -85,7 +86,7 @@ module cognitiveService 'br/public:avm/res/cognitive-services/account:0.11.0' =
name: take('cog-${kind}-${name}-deployment', 64)
params: {
name: nameFormatted
location: location
location: resourceGroup().location
tags: tags
sku: sku
kind: kind
Expand Down Expand Up @@ -114,7 +115,8 @@ module cognitiveServicePrivateEndpoint 'br/public:avm/res/network/private-endpoi
name: take('pep-${name}-deployment', 64)
params: {
name: 'pep-${nameFormatted}-cognitiveservices'
location: location
// Private endpoint must be in same region as the target subnet/VNet
location: virtualNetworkLocation
tags: tags
privateLinkServiceConnections: [
{
Expand Down