Skip to content

Commit ca28f7d

Browse files
Harsh-MicrosoftHarsh-Microsoft
committed
Enhance sample data processing scripts to manage public access for Azure resources
1 parent 2a5c194 commit ca28f7d

File tree

4 files changed

+127
-6
lines changed

4 files changed

+127
-6
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ celerybeat.pid
125125
# Environments
126126
.env
127127
.venv
128+
scriptenv
128129
env/
129130
venv/
130131
ENV/

‎infra/main.bicep‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1265,12 +1265,12 @@ module searchService 'br/public:avm/res/search/search-service:0.11.1' = {
12651265
aadAuthFailureMode: 'http401WithBearerChallenge'
12661266
}
12671267
}
1268-
cmkEnforcement: virtualNetworkEnabled ? 'Enabled' : null
12691268
disableLocalAuth: false
12701269
hostingMode: 'default'
12711270
managedIdentities: {
12721271
systemAssigned: true
12731272
}
1273+
publicNetworkAccess: virtualNetworkEnabled ? 'Disabled' : 'Enabled'
12741274
networkRuleSet: {
12751275
bypass: 'AzureServices'
12761276
}
@@ -1344,6 +1344,7 @@ output AZURE_STORAGE_BLOB_URL string = avmStorageAccount.outputs.serviceEndpoint
13441344
output AZURE_STORAGE_ACCOUNT_NAME string = storageAccountName
13451345
output AZURE_STORAGE_CONTAINER_NAME string = storageContainerName
13461346
output AZURE_SEARCH_ENDPOINT string = searchService.outputs.endpoint
1347+
output AZURE_SEARCH_NAME string = searchService.outputs.name
13471348

13481349
@export()
13491350
@description('The type for the Multi-Agent Custom Automation Engine Log Analytics Workspace resource configuration.')

‎infra/scripts/Process-Sample-Data.ps1‎

Lines changed: 61 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
param(
44
[string]$StorageAccount,
55
[string]$BlobContainer,
6-
[string]$AiSearch
6+
[string]$AiSearch,
7+
[string]$ResourceGroup
78
)
89

910
# Get parameters from azd env, if not provided
@@ -16,14 +17,18 @@ if (-not $BlobContainer) {
1617
}
1718

1819
if (-not $AiSearch) {
19-
$AiSearch = $(azd env get-value AZURE_SEARCH_ENDPOINT)
20+
$AiSearch = $(azd env get-value AZURE_SEARCH_NAME)
21+
}
22+
23+
if (-not $ResourceGroup) {
24+
$ResourceGroup = $(azd env get-value AZURE_RESOURCE_GROUP)
2025
}
2126

2227
$AzSubscriptionId = $(azd env get-value AZURE_SUBSCRIPTION_ID)
2328

2429
# Check if all required arguments are provided
2530
if (-not $StorageAccount -or -not $BlobContainer -or -not $AiSearch) {
26-
Write-Host "Usage: .\infra\scripts\Process-Sample-Data.ps1 -StorageAccount <StorageAccount> -BlobContainer <StorageContainerName> -AiSearch <AISearchName/AISearchEndpoint>"
31+
Write-Host "Usage: .\infra\scripts\Process-Sample-Data.ps1 -StorageAccount <StorageAccount> -BlobContainer <StorageContainerName> -AiSearch <AISearchName> [-ResourceGroup <ResourceGroup>]"
2732
exit 1
2833
}
2934

@@ -105,6 +110,40 @@ else {
105110
az account set --subscription $currentSubscriptionId
106111
}
107112

113+
$stIsPublicAccessDisabled = $false
114+
$srchIsPublicAccessDisabled = $false
115+
# Enable public access for resources
116+
if ($ResourceGroup) {
117+
$stPublicAccess = $(az storage account show --name $StorageAccount --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
118+
if ($stPublicAccess -eq "Disabled") {
119+
$stIsPublicAccessDisabled = $true
120+
Write-Host "Enabling public access for storage account: $StorageAccount"
121+
az storage account update --name $StorageAccount --public-network-access enabled --default-action Allow --output none
122+
if ($LASTEXITCODE -ne 0) {
123+
Write-Host "Error: Failed to enable public access for storage account."
124+
exit 1
125+
}
126+
}
127+
else {
128+
Write-Host "Public access is already enabled for storage account: $StorageAccount"
129+
}
130+
131+
$srchPublicAccess = $(az search service show --name $AiSearch --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
132+
if ($srchPublicAccess -eq "Disabled") {
133+
$srchIsPublicAccessDisabled = $true
134+
Write-Host "Enabling public access for search service: $AiSearch"
135+
az search service update --name $AiSearch --resource-group $ResourceGroup --public-network-access enabled --output none
136+
if ($LASTEXITCODE -ne 0) {
137+
Write-Host "Error: Failed to enable public access for search service."
138+
exit 1
139+
}
140+
}
141+
else {
142+
Write-Host "Public access is already enabled for search service: $AiSearch"
143+
}
144+
}
145+
146+
108147
# Upload sample files to blob storage
109148
Write-Host "Uploading sample files to blob storage..."
110149
$result = az storage blob upload-batch --account-name $StorageAccount --destination $BlobContainer --source "data/datasets" --auth-mode login --pattern "*" --overwrite --output none
@@ -187,4 +226,23 @@ if ($process.ExitCode -ne 0) {
187226
exit 1
188227
}
189228

229+
#disable public access for resources
230+
if ($stIsPublicAccessDisabled) {
231+
Write-Host "Disabling public access for storage account: $StorageAccount"
232+
az storage account update --name $StorageAccount --public-network-access disabled --default-action Deny --output none
233+
if ($LASTEXITCODE -ne 0) {
234+
Write-Host "Error: Failed to disable public access for storage account."
235+
exit 1
236+
}
237+
}
238+
239+
if ($srchIsPublicAccessDisabled) {
240+
Write-Host "Disabling public access for search service: $AiSearch"
241+
az search service update --name $AiSearch --resource-group $ResourceGroup --public-network-access disabled --output none
242+
if ($LASTEXITCODE -ne 0) {
243+
Write-Host "Error: Failed to disable public access for search service."
244+
exit 1
245+
}
246+
}
247+
190248
Write-Host "Script executed successfully. Sample Data Processed Successfully."

‎infra/scripts/process_sample_data.sh‎

Lines changed: 63 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
storageAccount="$1"
55
blobContainer="$2"
66
aiSearch="$3"
7+
resourceGroup="$4"
78

89
# get parameters from azd env, if not provided
910
if [ -z "$storageAccount" ]; then
@@ -15,14 +16,18 @@ if [ -z "$blobContainer" ]; then
1516
fi
1617

1718
if [ -z "$aiSearch" ]; then
18-
aiSearch=$(azd env get-value AZURE_SEARCH_ENDPOINT)
19+
aiSearch=$(azd env get-value AZURE_SEARCH_NAME)
20+
fi
21+
22+
if [ -z "$resourceGroup" ]; then
23+
resourceGroup=$(azd env get-value AZURE_RESOURCE_GROUP)
1924
fi
2025

2126
azSubscriptionId=$(azd env get-value AZURE_SUBSCRIPTION_ID)
2227

2328
# Check if all required arguments are provided
2429
if [ -z "$storageAccount" ] || [ -z "$blobContainer" ] || [ -z "$aiSearch" ]; then
25-
echo "Usage: $0 <StorageAccount> <StorageContainerName> <AISearchName/AISearchEndpoint>"
30+
echo "Usage: $0 <StorageAccount> <StorageContainerName> <AISearchName> [ResourceGroup]"
2631
exit 1
2732
fi
2833

@@ -77,6 +82,41 @@ else
7782
az account set --subscription "$currentSubscriptionId"
7883
fi
7984

85+
stIsPublicAccessDisabled=false
86+
srchIsPublicAccessDisabled=false
87+
#Enable Public Access for resources
88+
if [ -n "$resourceGroup" ]; then
89+
stPublicAccess=$(az storage account show --name "$storageAccount" --resource-group "$resourceGroup" --query "publicNetworkAccess" -o tsv)
90+
srchPublicAccess=$(az search service show --name "$aiSearch" --resource-group "$resourceGroup" --query "publicNetworkAccess" -o tsv)
91+
if [ "$stPublicAccess" == "Disabled" ]; then
92+
stIsPublicAccessDisabled=true
93+
echo "Enabling public access for storage account: $storageAccount"
94+
az storage account update --name "$storageAccount" --public-network-access enabled --default-action Allow --output none
95+
if [ $? -ne 0 ]; then
96+
echo "Error: Failed to enable public access for storage account."
97+
exit 1
98+
fi
99+
echo "Public access enabled for storage account: $storageAccount"
100+
else
101+
echo "Public access is already enabled for storage account: $storageAccount"
102+
fi
103+
104+
if [ "$srchPublicAccess" == "Disabled" ]; then
105+
srchIsPublicAccessDisabled=true
106+
echo "Enabling public access for search service: $aiSearch"
107+
az search service update --name "$aiSearch" --resource-group "$resourceGroup" --public-network-access enabled --output none
108+
if [ $? -ne 0 ]; then
109+
echo "Error: Failed to enable public access for search service."
110+
exit 1
111+
fi
112+
echo "Public access enabled for search service: $aiSearch"
113+
else
114+
echo "Public access is already enabled for search service: $aiSearch"
115+
fi
116+
117+
fi
118+
119+
80120
#Upload sample files to blob storage
81121
echo "Uploading sample files to blob storage..."
82122
az storage blob upload-batch --account-name "$storageAccount" --destination "$blobContainer" --source "data/datasets" --auth-mode login --pattern '*' --overwrite --output none
@@ -127,4 +167,25 @@ if [ $? -ne 0 ]; then
127167
exit 1
128168
fi
129169

170+
#disable public access for resources
171+
if [ "$stIsPublicAccessDisabled" = true ]; then
172+
echo "Disabling public access for storage account: $storageAccount"
173+
az storage account update --name "$storageAccount" --public-network-access disabled --default-action Deny --output none
174+
if [ $? -ne 0 ]; then
175+
echo "Error: Failed to disable public access for storage account."
176+
exit 1
177+
fi
178+
echo "Public access disabled for storage account: $storageAccount"
179+
fi
180+
181+
if [ "$srchIsPublicAccessDisabled" = true ]; then
182+
echo "Disabling public access for search service: $aiSearch"
183+
az search service update --name "$aiSearch" --resource-group "$resourceGroup" --public-network-access disabled --output none
184+
if [ $? -ne 0 ]; then
185+
echo "Error: Failed to disable public access for search service."
186+
exit 1
187+
fi
188+
echo "Public access disabled for search service: $aiSearch"
189+
fi
190+
130191
echo "Script executed successfully. Sample Data Processed Successfully."

0 commit comments

Comments
 (0)