Merge pull request #483 from microsoft/dev

feat: Merge the AVM WAF,Azd Quota check, EXP changes from dev to main

Author: Roopan-Microsoft

docs/DeploymentGuide.md

@@ -134,6 +134,42 @@ To adjust quota settings, follow these [steps](./AzureGPTQuotaSettings.md).
 
 </details>
 
+<details>
+
+  <summary><b>Reusing an Existing Log Analytics Workspace</b></summary>
+
+  To configure your environment to use an existing Log Analytics Workspace, follow these steps:
+
+  #### 1. Navigate to Azure Portal
+  Go to [Azure Portal](https://portal.azure.com)
+
+  #### 2. Find Your Log Analytics Workspace
+  - In the search bar at the top, type "Log Analytics workspaces" and select it.
+  - Click on the workspace  you want to use.
+
+  ![Log Analytics Resource List](../docs/images/logAnalyticsList.png)
+
+  #### 3. Copy Workspace Id
+  - In the Overview pane, Click on **JSON View**
+
+  ![Log Analytics](../docs/images/logAnalytics.png)
+
+  - Copy the **Resource ID** (this is your Workspace ID)
+
+  ![Log Analytics JSON](../docs/images/logAnalyticsJson.png)
+
+  #### 4. Set the Workspace ID in Your Environment
+  Run the following command in your terminal
+  ```bash
+  azd env set AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID '<Existing Log Analytics Workspace Id>'
+  ```
+  Replace `<Existing Log Analytics Workspace Id>` with the full Resource ID obtained from Step 3.
+
+  #### 5. Continue Deployment
+  Continue with the [deploying steps](#deploying-with-azd).
+
+</details>
+
 ### Deploying with AZD
 
 Once you've opened the project in [Codespaces](#github-codespaces), [Dev Containers](#vs-code-dev-containers), or [locally](#local-environment), you can deploy it to Azure by following these steps:

docs/images/logAnalytics.png

@@ -6,16 +6,25 @@ targetScope = 'resourceGroup'
 @description('A unique prefix for all resources in this deployment. This should be 3-20 characters long:')
 param environmentName string
 
+@minLength(1)
+@description('Secondary location for databases creation(example:eastus2):')
+param secondaryLocation string = 'eastus2'
+
+@description('Azure location for the solution. If not provided, it defaults to the resource group location.')
+param AZURE_LOCATION string=''
+
+// ========== AI Deployments Location ========== //
+@description('Location for AI deployments. This should be a valid Azure region where OpenAI services are available.')
 @metadata({
   azd: {
     type: 'location'
+    usageName: [
+      'OpenAI.GlobalStandard.gpt4.1,150'
+      'OpenAI.Standard.text-embedding-ada-002,80'
+    ]
   }
 })
-
-
-@minLength(1)
-@description('Secondary location for databases creation(example:eastus2):')
-param secondaryLocation string
+param aiDeploymentsLocation string
 
 @minLength(1)
 @description('GPT model deployment type:')
@@ -31,28 +40,26 @@ param gptModelName string = 'gpt-4.1'
 @description('Version of the GPT model to deploy:')
 param gptModelVersion string = '2025-04-14'
 
-param azureOpenaiAPIVersion string = '2024-05-01-preview'
+@description('API version for Azure OpenAI service. This should be a valid API version supported by the service.')
+param azureOpenaiAPIVersion string = '2025-01-01-preview'
 
 @minValue(10)
 @description('Capacity of the GPT deployment:')
 // You can increase this, but capacity is limited per model/region, so you will get errors if you go over
 // https://learn.microsoft.com/en-us/azure/ai-services/openai/quotas-limits
-param gptDeploymentCapacity int = 30
+param gptDeploymentCapacity int = 150
 
 @minLength(1)
 @description('Name of the Text Embedding model to deploy:')
-@allowed([
-  'text-embedding-ada-002'
-])
 param embeddingModel string = 'text-embedding-ada-002'
 
 var abbrs = loadJsonContent('./abbreviations.json')
 @minValue(10)
 @description('Capacity of the Embedding Model deployment')
 param embeddingDeploymentCapacity int = 80
 
+@description('Image tag for the App Service container. Default is "latest".')
 param imageTag string = 'latest'
-param AZURE_LOCATION string=''
 
 @description('Optional: Existing Log Analytics Workspace Resource ID')
 param existingLogAnalyticsWorkspaceId string = ''
@@ -91,7 +98,7 @@ module aifoundry 'deploy_ai_foundry.bicep' = {
   name: 'deploy_ai_foundry'
   params: {
     solutionName: solutionPrefix
-    solutionLocation: solutionLocation
+    solutionLocation: aiDeploymentsLocation
     keyVaultName: kvault.outputs.keyvaultName
     deploymentType: deploymentType
     gptModelName: gptModelName

docs/images/logAnalyticsJson.png

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "environmentName": {
+      "value": "${AZURE_ENV_NAME}"
+    },
+    "location": {
+      "value": "${AZURE_LOCATION}"
+    },
+    "secondaryLocation": {
+      "value": "${AZURE_ENV_SECONDARY_LOCATION}"
+    },
+    "gptModelVersion": {
+      "value": "${AZURE_ENV_MODEL_VERSION}"
+    },
+    "deploymentType": {
+      "value": "${AZURE_ENV_MODEL_DEPLOYMENT_TYPE}"
+    },
+    "gptModelName": {
+      "value": "${AZURE_ENV_MODEL_NAME}"
+    },
+    "azureOpenaiAPIVersion": {
+      "value": "${AZURE_ENV_OPENAI_API_VERSION}"
+    },
+    "gptDeploymentCapacity": {
+      "value": "${AZURE_ENV_MODEL_CAPACITY}"
+    },
+    "embeddingModel": {
+      "value": "${AZURE_ENV_EMBEDDING_MODEL_NAME}"
+    },
+    "embeddingDeploymentCapacity": {
+      "value": "${AZURE_ENV_EMBEDDING_MODEL_CAPACITY}"
+    },
+    "azureOpenaiAPIVersion ": {
+      "value": "${AZURE_ENV_OPENAI_API_VERSION}"
+    },
+    "imageTag": {
+      "value": "${AZURE_ENV_IMAGETAG}"
+    },
+    "existingLogAnalyticsWorkspaceId": {
+      "value": "${AZURE_ENV_LOG_ANALYTICS_WORKSPACE_ID}"
+    }
+  }
+}

docs/images/logAnalyticsList.png

@@ -46,12 +46,14 @@ if [ -z "$role_assignment" ]; then
     MSYS_NO_PATHCONV=1 az role assignment create --assignee $signed_user_id --role "Storage Blob Data Contributor" --scope $storage_account_resource_id --output none
     if [ $? -eq 0 ]; then
         echo "Role assignment completed successfully."
+        sleep 5
         retries=3
         while [ $retries -gt 0 ]; do
             # Check if the role assignment was successful
             role_assignment_check=$(MSYS_NO_PATHCONV=1 az role assignment list --assignee $signed_user_id --role "Storage Blob Data Contributor" --scope $storage_account_resource_id --query "[].roleDefinitionId" -o tsv)
             if [ -n "$role_assignment_check" ]; then
                 echo "Role assignment verified successfully."
+                sleep 5
                 break
             else
                 echo "Role assignment not found, retrying..."
@@ -93,6 +95,27 @@ unzip -o $zipUrl1 -d infra/data/"$extractedFolder1"
 # unzip /mnt/azscripts/azscriptinput/"$zipFileName2" -d /mnt/azscripts/azscriptinput/"$extractedFolder2"
 
 # Using az storage blob upload-batch to upload files with managed identity authentication, as the az storage fs directory upload command is not working with managed identity authentication.
-echo "Uploading files to Azure Storage"
+echo "Uploading files to Azure Blob Storage"
 az storage blob upload-batch --account-name "$storageAccount" --destination "$fileSystem"/"$extractedFolder1" --source infra/data/"$extractedFolder1" --auth-mode login --pattern '*' --overwrite --output none
+if [ $? -ne 0 ]; then
+    retries=3
+    sleepTime=10
+    echo "Error: Failed to upload files to Azure Blob Storage. Retrying upload...($((4 - retries)) of 3)"
+    while [ $retries -gt 0 ]; do
+        sleep $sleepTime
+        az storage blob upload-batch --account-name "$storageAccount" --destination "$fileSystem"/"$extractedFolder1" --source infra/data/"$extractedFolder1" --auth-mode login --pattern '*' --overwrite --output none
+        if [ $? -eq 0 ]; then
+            echo "Files uploaded successfully to Azure Blob Storage."
+            break
+        else
+            ((retries--))
+            echo "Retrying upload... ($((4 - retries)) of 3)"
+            sleepTime=$((sleepTime * 2))
+            sleep $sleepTime
+        fi
+    done
+    exit 1
+else
+    echo "Files uploaded successfully to Azure Blob Storage."
+fi
 # az storage blob upload-batch --account-name "$storageAccount" --destination data/"$extractedFolder2" --source /mnt/azscripts/azscriptinput/"$extractedFolder2" --auth-mode login --pattern '*' --overwrite

infra/main.bicep

@@ -34,12 +34,72 @@ if [ -z "$aiFoundryName" ]; then
     aiFoundryName=$(azd env get-value AI_FOUNDRY_NAME)
 fi
 
+azSubscriptionId=$(azd env get-value AZURE_SUBSCRIPTION_ID)
+
 # Check if all required arguments are provided
 if [ -z "$storageAccount" ] || [ -z "$fileSystem" ] || [ -z "$keyvaultName" ] || [ -z "$cosmosDbAccountName" ] || [ -z "$resourceGroupName" ] || [ -z "$aiFoundryName" ]; then
     echo "Usage: $0 <storageAccount> <storageContainerName> <keyvaultName> <cosmosDbAccountName> <resourceGroupName> <aiFoundryName>"
     exit 1
 fi
 
+# Authenticate with Azure
+if az account show &> /dev/null; then
+    echo "Already authenticated with Azure."
+else
+    if [ -n "$managedIdentityClientId" ]; then
+        # Use managed identity if running in Azure
+        echo "Authenticating with Managed Identity..."
+        az login --identity --client-id ${managedIdentityClientId}
+    else
+        # Use Azure CLI login if running locally
+        echo "Authenticating with Azure CLI..."
+        az login
+    fi
+    echo "Not authenticated with Azure. Attempting to authenticate..."
+fi
+
+#check if user has selected the correct subscription
+currentSubscriptionId=$(az account show --query id -o tsv)
+currentSubscriptionName=$(az account show --query name -o tsv)
+if [ "$currentSubscriptionId" != "$azSubscriptionId" ]; then
+    echo "Current selected subscription is $currentSubscriptionName ( $currentSubscriptionId )."
+    read -rp "Do you want to continue with this subscription?(y/n): " confirmation
+    if [[ "$confirmation" != "y" && "$confirmation" != "Y" ]]; then
+        echo "Fetching available subscriptions..."
+        availableSubscriptions=$(az account list --query "[?state=='Enabled'].[name,id]" --output tsv)
+        while true; do
+            echo ""
+            echo "Available Subscriptions:"
+            echo "========================"
+            echo "$availableSubscriptions" | awk '{printf "%d. %s ( %s )\n", NR, $1, $2}'
+            echo "========================"
+            echo ""
+            read -rp "Enter the number of the subscription (1-$(echo "$availableSubscriptions" | wc -l)) to use: " subscriptionIndex
+            if [[ "$subscriptionIndex" =~ ^[0-9]+$ ]] && [ "$subscriptionIndex" -ge 1 ] && [ "$subscriptionIndex" -le $(echo "$availableSubscriptions" | wc -l) ]; then
+                selectedSubscription=$(echo "$availableSubscriptions" | sed -n "${subscriptionIndex}p")
+                selectedSubscriptionName=$(echo "$selectedSubscription" | cut -f1)
+                selectedSubscriptionId=$(echo "$selectedSubscription" | cut -f2)
+
+                # Set the selected subscription
+                if  az account set --subscription "$selectedSubscriptionId"; then
+                    echo "Switched to subscription: $selectedSubscriptionName ( $selectedSubscriptionId )"
+                    break
+                else
+                    echo "Failed to switch to subscription: $selectedSubscriptionName ( $selectedSubscriptionId )."
+                fi
+            else
+                echo "Invalid selection. Please try again."
+            fi
+        done
+    else
+        echo "Proceeding with the current subscription: $currentSubscriptionName ( $currentSubscriptionId )"
+        az account set --subscription "$currentSubscriptionId"
+    fi
+else
+    echo "Proceeding with the subscription: $currentSubscriptionName ( $currentSubscriptionId )"
+    az account set --subscription "$currentSubscriptionId"
+fi
+
 # Call add_cosmosdb_access.sh
 echo "Running add_cosmosdb_access.sh"
 bash infra/scripts/add_cosmosdb_access.sh "$resourceGroupName" "$cosmosDbAccountName" "$managedIdentityClientId"

infra/main.bicepparam

@@ -20,11 +20,11 @@ This will create a virtual environment directory named microsoft inside your cur
 Installing Playwright Pytest from Virtual Environment
 
 - To install libraries run "pip install -r requirements.txt"
-- Install the required browsers "playwright install"
+
 
 Run test cases
 
-- To run test cases from your 'tests' folder : "pytest --html=report.html --self-contained-html"
+- To run test cases from your 'tests/e2e-test' folder : "pytest --html=report.html --self-contained-html"
 
 Create .env file in project root level with web app url and client credentials