Skip to content

Commit 724b0db

Browse files
TravisHilbertTravisHilbert
committed
removing some ID resources
1 parent 100701a commit 724b0db

File tree

5 files changed

+1110
-110
lines changed

5 files changed

+1110
-110
lines changed

‎infra/deploy_ai_foundry.bicep‎

Lines changed: 300 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,300 @@
1+
// Creates Azure dependent resources for Azure AI studio
2+
param solutionName string
3+
param solutionLocation string
4+
param keyVaultName string
5+
param gptModelName string
6+
param gptModelVersion string
7+
param managedIdentityObjectId string
8+
param aiServicesEndpoint string
9+
param aiServicesKey string
10+
param aiServicesId string
11+
12+
var storageName = '${solutionName}hubstorage'
13+
var storageSkuName = 'Standard_LRS'
14+
var aiServicesName = '${solutionName}-aiservices'
15+
var workspaceName = '${solutionName}-workspace'
16+
var keyvaultName = '${solutionName}-kv'
17+
var location = solutionLocation
18+
var aiHubName = '${solutionName}-aihub'
19+
var aiHubFriendlyName = aiHubName
20+
var aiHubDescription = 'AI Hub for KM template'
21+
var aiProjectName = '${solutionName}-aiproject'
22+
var aiProjectFriendlyName = aiProjectName
23+
var aiSearchName = '${solutionName}-search'
24+
25+
26+
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
27+
name: keyVaultName
28+
}
29+
30+
resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
31+
name: workspaceName
32+
location: location
33+
tags: {}
34+
properties: {
35+
retentionInDays: 30
36+
sku: {
37+
name: 'PerGB2018'
38+
}
39+
}
40+
}
41+
42+
43+
var storageNameCleaned = replace(storageName, '-', '')
44+
45+
46+
resource storage 'Microsoft.Storage/storageAccounts@2022-09-01' = {
47+
name: storageNameCleaned
48+
location: location
49+
sku: {
50+
name: storageSkuName
51+
}
52+
kind: 'StorageV2'
53+
identity: {
54+
type: 'SystemAssigned'
55+
}
56+
properties: {
57+
accessTier: 'Hot'
58+
allowBlobPublicAccess: false
59+
allowCrossTenantReplication: false
60+
allowSharedKeyAccess: false
61+
encryption: {
62+
keySource: 'Microsoft.Storage'
63+
requireInfrastructureEncryption: false
64+
services: {
65+
blob: {
66+
enabled: true
67+
keyType: 'Account'
68+
}
69+
file: {
70+
enabled: true
71+
keyType: 'Account'
72+
}
73+
queue: {
74+
enabled: true
75+
keyType: 'Service'
76+
}
77+
table: {
78+
enabled: true
79+
keyType: 'Service'
80+
}
81+
}
82+
}
83+
isHnsEnabled: false
84+
isNfsV3Enabled: false
85+
keyPolicy: {
86+
keyExpirationPeriodInDays: 7
87+
}
88+
largeFileSharesState: 'Disabled'
89+
minimumTlsVersion: 'TLS1_2'
90+
networkAcls: {
91+
bypass: 'AzureServices'
92+
defaultAction: 'Allow'
93+
}
94+
supportsHttpsTrafficOnly: true
95+
}
96+
}
97+
98+
@description('This is the built-in Storage Blob Data Contributor.')
99+
resource blobDataContributor 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
100+
scope: subscription()
101+
name: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
102+
}
103+
104+
resource storageroleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
105+
name: guid(resourceGroup().id, managedIdentityObjectId, blobDataContributor.id)
106+
scope: storage
107+
properties: {
108+
principalId: managedIdentityObjectId
109+
roleDefinitionId: blobDataContributor.id
110+
principalType: 'ServicePrincipal'
111+
}
112+
}
113+
114+
resource aiHub 'Microsoft.MachineLearningServices/workspaces@2023-08-01-preview' = {
115+
name: aiHubName
116+
location: location
117+
identity: {
118+
type: 'SystemAssigned'
119+
}
120+
properties: {
121+
// organization
122+
friendlyName: aiHubFriendlyName
123+
description: aiHubDescription
124+
125+
// dependent resources
126+
keyVault: keyVault.id
127+
storageAccount: storage.id
128+
}
129+
kind: 'hub'
130+
131+
resource aiServicesConnection 'connections@2024-07-01-preview' = {
132+
name: '${aiHubName}-connection-AzureOpenAI'
133+
properties: {
134+
category: 'AIServices'
135+
target: aiServicesEndpoint
136+
authType: 'ApiKey'
137+
isSharedToAll: true
138+
credentials: {
139+
key: aiServicesKey
140+
}
141+
metadata: {
142+
ApiType: 'Azure'
143+
ResourceId: aiServicesId
144+
}
145+
}
146+
}
147+
}
148+
149+
resource aiHubProject 'Microsoft.MachineLearningServices/workspaces@2024-01-01-preview' = {
150+
name: aiProjectName
151+
location: location
152+
kind: 'Project'
153+
identity: {
154+
type: 'SystemAssigned'
155+
}
156+
properties: {
157+
friendlyName: aiProjectFriendlyName
158+
hubResourceId: aiHub.id
159+
}
160+
}
161+
162+
resource tenantIdEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
163+
parent: keyVault
164+
name: 'TENANT-ID'
165+
properties: {
166+
value: subscription().tenantId
167+
}
168+
}
169+
170+
resource azureOpenAIInferenceEndpoint 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
171+
parent: keyVault
172+
name: 'AZURE-OPENAI-INFERENCE-ENDPOINT'
173+
properties: {
174+
value:''
175+
}
176+
}
177+
178+
resource azureOpenAIInferenceKey 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
179+
parent: keyVault
180+
name: 'AZURE-OPENAI-INFERENCE-KEY'
181+
properties: {
182+
value:''
183+
}
184+
}
185+
186+
resource azureOpenAIApiKeyEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
187+
parent: keyVault
188+
name: 'AZURE-OPENAI-KEY'
189+
properties: {
190+
value: aiServicesKey //aiServices_m.listKeys().key1
191+
}
192+
}
193+
194+
resource azureOpenAIDeploymentModel 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
195+
parent: keyVault
196+
name: 'AZURE-OPEN-AI-DEPLOYMENT-MODEL'
197+
properties: {
198+
value: gptModelName
199+
}
200+
}
201+
202+
resource azureOpenAIApiVersionEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
203+
parent: keyVault
204+
name: 'AZURE-OPENAI-PREVIEW-API-VERSION'
205+
properties: {
206+
value: gptModelVersion //'2024-02-15-preview'
207+
}
208+
}
209+
210+
resource azureOpenAIEndpointEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
211+
parent: keyVault
212+
name: 'AZURE-OPENAI-ENDPOINT'
213+
properties: {
214+
value: aiServicesEndpoint//aiServices_m.properties.endpoint
215+
}
216+
}
217+
218+
resource azureAIProjectConnectionStringEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
219+
parent: keyVault
220+
name: 'AZURE-AI-PROJECT-CONN-STRING'
221+
properties: {
222+
value: '${split(aiHubProject.properties.discoveryUrl, '/')[2]};${subscription().subscriptionId};${resourceGroup().name};${aiHubProject.name}'
223+
}
224+
}
225+
226+
resource azureOpenAICUApiVersionEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
227+
parent: keyVault
228+
name: 'AZURE-OPENAI-CU-VERSION'
229+
properties: {
230+
value: '?api-version=2024-12-01-preview'
231+
}
232+
}
233+
234+
resource azureSearchIndexEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
235+
parent: keyVault
236+
name: 'AZURE-SEARCH-INDEX'
237+
properties: {
238+
value: 'transcripts_index'
239+
}
240+
}
241+
242+
resource cogServiceEndpointEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
243+
parent: keyVault
244+
name: 'COG-SERVICES-ENDPOINT'
245+
properties: {
246+
value: aiServicesEndpoint
247+
}
248+
}
249+
250+
resource cogServiceKeyEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
251+
parent: keyVault
252+
name: 'COG-SERVICES-KEY'
253+
properties: {
254+
value: aiServicesKey
255+
}
256+
}
257+
258+
resource cogServiceNameEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
259+
parent: keyVault
260+
name: 'COG-SERVICES-NAME'
261+
properties: {
262+
value: aiServicesName
263+
}
264+
}
265+
266+
resource azureSubscriptionIdEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
267+
parent: keyVault
268+
name: 'AZURE-SUBSCRIPTION-ID'
269+
properties: {
270+
value: subscription().subscriptionId
271+
}
272+
}
273+
274+
resource resourceGroupNameEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
275+
parent: keyVault
276+
name: 'AZURE-RESOURCE-GROUP'
277+
properties: {
278+
value: resourceGroup().name
279+
}
280+
}
281+
282+
resource azureLocatioEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
283+
parent: keyVault
284+
name: 'AZURE-LOCATION'
285+
properties: {
286+
value: solutionLocation
287+
}
288+
}
289+
290+
output keyvaultName string = keyvaultName
291+
output keyvaultId string = keyVault.id
292+
293+
output aiServicesName string = aiServicesName
294+
output aiSearchName string = aiSearchName
295+
output aiProjectName string = aiHubProject.name
296+
297+
output storageAccountName string = storageNameCleaned
298+
299+
output logAnalyticsId string = logAnalytics.id
300+
output storageAccountId string = storage.id

‎infra/deploy_keyvault.bicep‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
@minLength(3)
2+
@maxLength(15)
3+
@description('Solution Name')
4+
param solutionName string
5+
param solutionLocation string
6+
param managedIdentityObjectId string
7+
8+
var keyvaultName = '${solutionName}-kv'
9+
10+
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
11+
name: keyvaultName
12+
location: solutionLocation
13+
properties: {
14+
createMode: 'default'
15+
accessPolicies: [
16+
{
17+
objectId: managedIdentityObjectId
18+
permissions: {
19+
certificates: [
20+
'all'
21+
]
22+
keys: [
23+
'all'
24+
]
25+
secrets: [
26+
'all'
27+
]
28+
storage: [
29+
'all'
30+
]
31+
}
32+
tenantId: subscription().tenantId
33+
}
34+
]
35+
enabledForDeployment: true
36+
enabledForDiskEncryption: true
37+
enabledForTemplateDeployment: true
38+
enableSoftDelete: false
39+
enableRbacAuthorization: true
40+
enablePurgeProtection: true
41+
publicNetworkAccess: 'enabled'
42+
sku: {
43+
family: 'A'
44+
name: 'standard'
45+
}
46+
softDeleteRetentionInDays: 7
47+
tenantId: subscription().tenantId
48+
}
49+
}
50+
51+
@description('This is the built-in Key Vault Administrator role.')
52+
resource kvAdminRole 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
53+
scope: resourceGroup()
54+
name: '00482a5a-887f-4fb3-b363-3b7fe8e74483'
55+
}
56+
57+
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
58+
name: guid(resourceGroup().id, managedIdentityObjectId, kvAdminRole.id)
59+
properties: {
60+
principalId: managedIdentityObjectId
61+
roleDefinitionId:kvAdminRole.id
62+
principalType: 'ServicePrincipal'
63+
}
64+
}
65+
66+
output keyvaultName string = keyvaultName
67+
output keyvaultId string = keyVault.id

0 commit comments

Comments
 (0)