KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #developer-tools #ai-agent #claude-code #codex #typescript #ai-agents #deepseek-harness #mcp #cli #rust

terraform-azurerm-avm-ptn-aiml-ai-foundry

★ 14 Open GitHub ↗

Terraform Azure Verified Pattern Module for Azure AI Foundry Pattern

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Azure AI Foundry Pattern Module

Deploys Azure AI Foundry (account, projects, agent service, connections, RBAC) and lets you either bring your own dependent data services or have the module create them for you. Use **BYOR** for production AI landing zones, **CYOR** for POCs.

## What this module deploys

| Category | Resources | Notes |
| --- | --- | --- |
| **Core** (always deployed) | <ul><li>AI Foundry account</li><li>Projects</li><li>Connections</li><li>RBAC</li><li>Resource locks</li><li>Agent capability host (optional)</li></ul> | Module-owned. |
| **Dependent data services** (BYOR or CYOR) | <ul><li>Key Vault</li><li>Storage Account</li><li>Cosmos DB</li><li>AI Search</li></ul> | Either bring existing IDs (BYOR) or let the module create them (CYOR). See [Production guidance](#production-guidance-byor-vs-cyor). |
| **Networking** (private deployments) | <ul><li>Foundry private endpoint</li><li>VNet, subnets, private DNS (example)</li><li>Bastion, jump VM (example)</li></ul> | Foundry PE is module-owned. VNet / DNS / Bastion / VM live in the examples and in your landing zone. Designed to pair with the [AI Landing Zone Accelerator](https://github.com/Azure/terraform-azurerm-avm-ptn-aiml-landing-zone). |
| **Observability** | <ul><li>Diagnostic settings</li><li>Log Analytics workspace (example)</li></ul> | Workspace lives in the example / landing zone. |

## Production guidance: BYOR vs CYOR

This module supports two ways of providing the dependent data services (Key Vault, Storage Account, Cosmos DB, AI Search):

| Mode | What it does | Resources you own | Use it for |
| --- | --- | --- | --- |
| **BYOR** (Bring Your Own Resource) | You provision the dependent data services **outside** this module (typically in your landing zone) and pass their IDs in as variables. The module only wires up connections, RBAC, and the Foundry account itself. | <ul><li>Key Vault</li><li>Storage Account</li><li>Cosmos DB</li><li>AI Search</li></ul> | **Production. This is the only supported path for production AI landing zones.** |
| **CYOR** (Create Your Own Resource, the in-module path) | The module provisions the dependent data services for you with opinionated defaults. | <ul><li>Key Vault</li><li>Storage Account</li><li>Cosmos DB</li><li>AI Search</li></ul> (created by the module) | **POC / MVP / demos only.** Fast path to a working Foundry environment when you don't yet have a landing zone. |

### Why BYOR is the production path

- **Lifecycle separation.** Data services typically outlive the Foundry account they back. Owning them outside the pattern module means a `terraform destroy` of the Foundry stack cannot take down a Cosmos DB or Storage account that other workloads depend on.
- **Governance and policy.** In an AI landing zone, Key Vault / Storage / Cosmos / Search are governed by platform teams (naming, encryption, network access, diagnostic settings, DINE/Modify policies, private DNS). Letting this module create them re-introduces drift with those platform controls.
- **Reduced blast radius and dependencies.** BYOR keeps this module focused on what is genuinely Foundry-specific (the account, projects, connections, RBAC, agent capability host) and removes long dependency chains during plan/apply.
- **Shared resources across projects/environments.** Production deployments commonly share one Cosmos DB or one Storage account across multiple Foundry projects or environments. That sharing only works cleanly when those resources live outside any single module instance.
- **Multi-region and cross-region patterns.** PE placement, regional pinning, and cross-region wiring are landing-zone concerns, not module concerns.

### What this means for issues and feature requests

- Feature requests that **only** affect the CYOR path (e.g., exposing additional knobs on the module-created Storage account, Key Vault, Cosmos DB, AI Search, or their private endpoints) will generally **not be accepted**. The recommended fix is to switch to BYOR and configure those properties on your own resources.
- Feature requests that affect the **Foundry account, projects, agent service, connections, RBAC, or the Foundry account's own private endpoint** apply to both modes and are in scope regardless of BYOR/CYOR.
- See the `standard-*-byor` examples for reference BYOR deployments.

## Example Deployments

| Example                   | Description                                | Key Features                                      |
| ------------------------- | ------------------------------------------ | ------------------------------------------------- |
| **basic**                 | Minimal AI Foundry deployment              | AI Foundry + Project only, public access          |
| **standard-public**       | Full-featured public deployment            | All services, public endpoints, complete setup    |
| **standard-public-byor**  | Public deployment with existing resources  | Uses existing Storage/KeyVault/Cosmos/Search      |
| **standard-private**      | Enterprise-grade private deployment        | Private endpoints, VNet isolation, Bastion access |
| **standard-private-byor** | Private deployment with existing resources | Private + existing resources combination          |

## Requirements

The following requirements are needed by this module:

- <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) (>= 1.12, < 2.0)

- <a name="requirement_azapi"></a> [azapi](#requirement\_azapi) (~> 2.5)

- <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) (~> 4.38)

- <a name="requirement_modtm"></a> [modtm](#requirement\_modtm) (~> 0.3)

- <a name="requirement_random"></a> [random](#requirement\_random) (~> 3.7)

- <a name="requirement_time"></a> [time](#requirement\_time) (~> 0.13)

## Resources

The following resources are used by this module:

- [azapi_resource.ai_agent_capability_host](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource) (resource)
- [azapi_resource.ai_foundry](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource) (resource)
- [azapi_resource.ai_model_deployment](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource) (resource)
- [azapi_resource.ai_search](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource) (resource)
- [azapi_update_resource.ai_foundry_cmk](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/update_resource) (resource)
- [azurerm_monitor_diagnostic_setting.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) (resource)
- [azurerm_monitor_diagnostic_setting.this_aisearch](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) (resource)
- [azurerm_private_endpoint.ai_foundry](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) (resource)
- [azurerm_private_endpoint.pe_aisearch](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) (resource)
- [azurerm_private_endpoint.unmanaged_ai_foundry](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) (resource)
- [azurerm_private_endpoint.unmanaged_pe_aisearch](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) (resource)
- [azurerm_role_assignment.cmk_key_vault_crypto_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
- [azurerm_role_assignment.foundry_role_assignments](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
- [azurerm_role_assignment.this_aisearch](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
- [modtm_telemetry.telemetry](https://registry.terraform.io/providers/azure/modtm/latest/docs/resources/telemetry) (resource)
- [random_string.resource_token](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) (resource)
- [random_uuid.telemetry](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) (resource)
- [time_sleep.ai_foundry_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) (resource)
- [time_sleep.cmk_rbac_wait](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) (resource)
- [azapi_client_config.telemetry](https://registry.terraform.io/providers/Azure/azapi/latest/docs/data-sources/client_config) (data source)
- [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) (data source)
- [azurerm_key_vault.cmk](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/key_vault) (data source)
- [azurerm_key_vault_key.cmk](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/key_vault_key) (data source)
- [azurerm_user_assigned_identity.ai_foundry_account](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/user_assigned_identity) (data source)
- [azurerm_user_assigned_identity.cmk](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/user_assigned_identity) (data source)
- [modtm_module_source.telemetry](https://registry.terraform.io/providers/azure/modtm/latest/docs/data-sources/module_source) (data source)

## Required Inputs

The following input variables are required:

### <a name="input_base_name"></a> [base\_name](#input\_base\_name)

Description: The name prefix for the AI Foundry resources.

Type: `string`

### <a name="input_location"></a> [location](#input\_location)

Description: Azure region where the resource should be deployed.

Type: `string`

### <a name="input_resource_group_resource_id"></a> [resource\_group\_resource\_id](#input\_resource\_group\_resource\_id)

Description: The resource group resource id where the module resources will be deployed.

Type: `string`

## Optional Inputs

The following input variables are optional (have default values):

### <a name="input_ai_foundry"></a> [ai\_foundry](#input\_ai\_foundry)

Description: Configuration object for the Azure AI Foundry service to be created for AI workloads and model management.

- `name` - (Optional) The name of the AI Foundry service. If not provided, a name will be generated.
- `disable_local_auth` - (Optional) Whether to disable local authentication for the AI Foundry service. Default is false.
- `allow_project_management` - (Optional) Whether to allow project management capabilities in the AI Foundry service. Default is true.
- `create_ai_agent_service` - (Optional) Whether to create an AI agent service as part of the AI Foundry deployment. Default is false.
- `network_injections` - (Optional) List of network injection configurations for the AI Foundry service.
  - `scenario` - (Optional) The scenario for the network injection. Default is "agent".
  - `subnetArmId` - The subnet ARM ID for the AI agent service.
  - `useMicrosoftManagedNetwork` - (Optional) Whether to use Microsoft managed network for the injection. Default is false.
- `private_dns_zone_resource_ids` - (Optional) The resource IDs of the existing private DNS zones for AI Foundry. Required when `create_private_endpoints` is true and `private_endpoint.unmanaged_dns_zone_group_enabled` is false.
- `sku` - (Optional) The SKU of the AI Foundry service. Default is "S0".
- `public_network_access_enabled` - (Optional) Override the public network access setting on the Foundry account. When null (default), the value is derived from `create_private_endpoints` (`false` when private endpoints are enabled, `true` otherwise). Set to `true` or `false` to override.
- `network_acls` - (Optional) Network ACLs applied to the Foundry account. When null (default), the account allows traffic from all networks. Set to restrict traffic when running in production landing zones.
  - `default_action` - (Optional) `Allow` or `Deny`. Default `Allow`.
  - `bypass` - (Optional) Bypass rule for trusted Azure services. Use `AzureServices` to permit Microsoft services to bypass the rules.
  - `ip_rules` - (Optional) List of CIDR ranges or IPv4 addresses allowed inbound access.
  - `virtual_network_rules` - (Optional) List of subnet objects allowed inbound access. Each entry requires `subnet_resource_id` and optionally `ignore_missing_vnet_service_endpoint`.
- `private_endpoint` - (Optional) Override block for the AI Foundry account private endpoint. All fields are optional and fall back to the root-level `private_endpoint_subnet_resource_id`, `resource_group_resource_id`, `location`, and the top-level `private_dns_zone_resource_ids` when null. Used when the Foundry account PE must live in a different resource group, region, subnet, or use unmanaged DNS.
  - `resource_group_resource_id` - (Optional) Resource ID of the resource group hosting the private endpoint. Defaults to the module's resource group.
  - `location` - (Optional) Azure region for the private endpoint. Defaults to the module's location.
  - `subnet_resource_id` - (Optional) Subnet resource ID for the private endpoint NIC. Defaults to `private_endpoint_subnet_resource_id`.
  - `private_dns_zone_resource_ids` - (Optional) Override list of private DNS zone resource IDs. Defaults to `ai_foundry.private_dns_zone_resource_ids`.
  - `unmanaged_dns_zone_group_enabled` - (Optional) When true, no `private_dns_zone_group` is created on the private endpoint. Use this when DNS A records are produced by an Azure Policy (DINE/Modify) on the platform DNS zones in a hub subscription. Default false.
- `managed_identities` - (Optional) Identity configuration for the AI Foundry account.
  - `system_assigned` - (Optional) Enable the system-assigned managed identity. Default true.
  - `user_assigned_resource_ids` - (Optional) Set of user-assigned managed identity resource IDs to attach to the account. When the Foundry account also creates an AI Agent service, every user-assigned identity is granted the Cosmos DB and Storage data-plane roles required by the Standard Agent Setup.
- `customer_managed_key` - (Optional) Customer-managed key encryption configuration. Requires a Key Vault with an existing key and a user-assigned managed identity with "Key Vault Crypto User" role on the Key Vault.
  - `key_vault_resource_id` - Resource ID of the Key Vault containing the encryption key.
  - `key_name` - Name of the Key Vault key to use for encryption.
  - `key_version` - (Optional) Version of the Key Vault key. If not specified, uses the latest version.
  - `user_assigned_identity_resource_id` - Resource ID of the user-assigned managed identity with access to the Key Vault.
- `role_assignments` - (Optional) Map of role assignments to create on the AI Foundry service. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
  - `role_definition_id_or_name` - The role definition ID or name to assign.
  - `principal_id` - The principal ID to assign the role to.
  - `description` - (Optional) Description of the role assignment.
  - `skip_service_principal_aad_check` - (Optional) Whether to skip AAD check for service principal.
  - `condition` - (Optional) Condition for the role assignment.
  - `condition_version` - (Optional) Version of the condition.
  - `delegated_managed_identity_resource_id` - (Optional) Resource ID of the delegated managed identity.
  - `principal_type` - (Optional) Type of the principal (User, Group, ServicePrincipal).

Type:

```hcl
object({
    name                     = optional(string, null)
    disable_local_auth       = optional(bool, false)
    allow_project_management = optional(bool, true)
    create_ai_agent_service  = optional(bool, false)
    network_injections = optional(list(object({
      scenario                   = optional(string, "agent")
      subnetArmId                = string
      useMicrosoftManagedNetwork = optional(bool, false)
    })), null)
    private_dns_zone_resource_ids = optional(list(string), [])
    sku                           = optional(string, "S0")
    public_network_access_enabled = optional(bool, null)
    network_acls = optional(object({
      default_action = optional(string, "Allow")
      bypass         = optional(string, null)
      ip_rules       = optional(list(string), [])
      virtual_network_rules = optional(list(object({
        subnet_resource_id                   = string
        ignore_missing_vnet_service_endpoint = optional(bool, false)
      })), [])
    }), null)
    managed_identities = optional(object({
      system_assigned            = optional(bool, true)
      user_assigned_resource_ids = optional(set(string), [])
    }), { system_assigned = true, user_assigned_resource_ids = [] })
    customer_managed_key = optional(object({
      key_vault_resource_id              = string
      key_name                           = string
      key_version                        = optional(string, null)
      user_assigned_identity_resource_id = string
    }), null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
  })
```

Default: `{}`

### <a name="input_ai_model_deployments"></a> [ai\_model\_deployments](#input\_ai\_model\_deployments)

Description: Configuration for AI model deployments (including OpenAI). Each deployment includes:
- `name` - The name of the deployment
- `rai_policy_name` - (Optional) The name of the RAI policy. Default is "Microsoft.DefaultV2".
- `version_upgrade_option` - (Optional) How to handle version upgrades (default: "OnceNewDefaultVersionAvailable")
- `model` - The model configuration:
  - `format` - The format of the model (e.g., "OpenAI")
  - `name` - The name of the model to deploy
  - `version` - The version of the model
- `scale` - The scaling configuration:
  - `type` - The scaling type (e.g., "Standard")
  - `capacity` - (Optional) The capacity of the deployment
  - `family` - (Optional) The family of the deployment
  - `size` - (Optional) The size of the deployment
  - `tier` - (Optional) The pricing tier for the deployment

Type:

```hcl
map(object({
    name                   = string
    rai_policy_name        = optional(string, "Microsoft.DefaultV2")
    version_upgrade_option = optional(string, "OnceNewDefaultVersionAvailable")
    model = object({
      format  = string
      name    = string
      version = string
    })
    scale = object({
      capacity = optional(number)
      family   = optional(string)
      size     = optional(string)
      tier     = optional(string)
      type     = string
    })
  }))
```

Default: `{}`

### <a name="input_ai_projects"></a> [ai\_projects](#input\_ai\_projects)

Description: Configuration map for AI Foundry projects to be created. Each project can have its own settings and connections to dependent resources.

- `map key` - The key for the map entry. This key should match the dependent resources keys when creating connections.
  - `name` - The name of the AI Foundry project.
  - `sku` - (Optional) The SKU of the AI Foundry project. Default is "S0".
  - `display_name` - The display name of the AI Foundry project.
  - `description` - The description of the AI Foundry project.
  - `create_project_connections` - (Optional) Whether to create connections to dependent resources. Default is false.
  - `cosmos_db_connection` - (Optional) Configuration for Cosmos DB connection.
    - `existing_resource_id` - (Optional) The resource ID of an existing Cosmos DB account to connect to.
    - `new_resource_map_key` - (Optional) The map key of a new Cosmos DB account to be created and connected.
  - `ai_search_connection` - (Optional) Configuration for AI Search connection.
    - `existing_resource_id` - (Optional) The resource ID of an existing AI Search service to connect to.
    - `new_resource_map_key` - (Optional) The map key of a new AI Search service to be created and connected.
  - `key_vault_connection` - (Optional) Configuration for Key Vault connection.
    - `existing_resource_id` - (Optional) The resource ID of an existing Key Vault to connect to.
    - `new_resource_map_key` - (Optional) The map key of a new Key Vault to be created and connected.
  - `storage_account_connection` - (Optional) Configuration for Storage Account connection.
    - `existing_resource_id` - (Optional) The resource ID of an existing Storage Account to connect to.
    - `new_resource_map_key` - (Optional) The map key of a new Storage Account to be created and connected.

Type:

```hcl
map(object({
    name                       = string
    sku                        = optional(string, "S0")
    display_name               = string
    description                = string
    create_project_connections = optional(bool, false)
    cosmos_db_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
    ai_search_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
    key_vault_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
    storage_account_connection = optional(object({
      existing_resource_id = optional(string, null)
      new_resource_map_key = optional(string, null)
    }), {})
  }))
```

Default: `{}`

### <a name="input_ai_search_definition"></a> [ai\_search\_definition](#input\_ai\_search\_definition)

Description: Configuration object for the Azure AI Search service to be created as part of the enterprise and public knowledge services.

- `map key` - The key for the map entry. This key should match the AI project key when creating multiple projects with multiple AI search services.
  - `existing_resource_id` - (Optional) The resource ID of an existing AI Search service to use. If provided, the service will not be created and the other inputs will be ignored.
  - `name` - (Optional) The name of the AI Search service. If not provided, a name will be generated.
  - `private_dns_zone_resource_id` - (Optional) The resource ID of the existing private DNS zone for AI Search. If not provided or set to null, no DNS zone group will be created.
  - `diagnostic_settings` - (Optional) A map of diagnostic settings to create. Each entry follows the AVM diagnostic\_settings interface.
  - `sku` - (Optional) The SKU of the AI Search service. Default is "standard".
  - `local_authentication_enabled` - (Optional) Whether local authentication is enabled. Default is true.
  - `partition_count` - (Optional) The number of partitions for the search service. Default is 1.
  - `replica_count` - (Optional) The number of replicas for the search service. Default is 2.
  - `semantic_search` - (Optional) The semantic search tier. Possible values are "disabled", "free", or "standard". Default is "disabled".
  - `hosting_mode` - (Optional) The hosting mode for the search service. Default is "default".
  - `tags` - (Optional) Map of tags to assign to the AI Search service.
  - `role_assignments` - (Optional) Map of role assignments to create on the AI Search service. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    - `role_definition_id_or_name` - The role definition ID or name to assign.
    - `principal_id` - The principal ID to assign the role to.
    - `description` - (Optional) Description of the role assignment.
    - `skip_service_principal_aad_check` - (Optional) Whether to skip AAD check for service principal.
    - `condition` - (Optional) Condition for the role assignment.
    - `condition_version` - (Optional) Version of the condition.
    - `delegated_managed_identity_resource_id` - (Optional) Resource ID of the delegated managed identity.
    - `principal_type` - (Optional) Type of the principal (User, Group, ServicePrincipal).
  - `enable_telemetry` - (Optional) Whether telemetry is enabled for the AI Search module. Default is true.

Type:

```hcl
map(object({
    existing_resource_id         = optional(string, null)
    name                         = optional(string)
    private_dns_zone_resource_id = optional(string, null)
    diagnostic_settings = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    sku                          = optional(string, "standard")
    local_authentication_enabled = optional(bool, true)
    partition_count              = optional(number, 1)
    replica_count                = optional(number, 2)
    semantic_search              = optional(string, "disabled")
    hosting_mode                 = optional(string, "default")
    tags                         = optional(map(string), {})
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    enable_telemetry = optional(bool, true)
  }))
```

Default: `{}`

### <a name="input_cognitive_services_api_version"></a> [cognitive\_services\_api\_version](#input\_cognitive\_services\_api\_version)

Description: API version used for Microsoft.CognitiveServices account resources. Use `2025-07-01-preview` for compatibility with AzAPI provider versions that do not include `2025-10-01-preview`.

Type: `string`

Default: `"2025-10-01-preview"`

### <a name="input_cosmosdb_definition"></a> [cosmosdb\_definition](#input\_cosmosdb\_definition)

Description: Configuration object for the Azure Cosmos DB account to be created for GenAI services.

- `map key` - The key for the map entry. This key should match the AI project key when creating multiple projects and multiple CosmosDB accounts.
  - `existing_resource_id` - (Optional) The resource ID of an existing Cosmos DB account to use. If provided, the account will not be created and the other inputs will be ignored.
  - `private_dns_zone_resource_id` - (Optional) The resource ID of the existing private DNS zone for Cosmos DB. If not provided or set to null, no DNS zone group will be created.
  - `diagnostic_settings` - (Optional) A map of diagnostic settings to create. Each entry follows the AVM diagnostic\_settings interface.
  - `name` - (Optional) The name of the Cosmos DB account. If not provided, a name will be generated.
  - `secondary_regions` - (Optional) List of secondary regions for geo-replication.
    - `location` - The Azure region for the secondary location.
    - `zone_redundant` - (Optional) Whether zone redundancy is enabled for the secondary region. Default is true.
    - `failover_priority` - (Optional) The failover priority for the secondary region. Default is 0.
  - `public_network_access_enabled` - (Optional) Whether public network access is enabled. Default is false.
  - `analytical_storage_enabled` - (Optional) Whether analytical storage is enabled. Default is `false`. Azure no longer permits enabling Analytical Storage during account creation; set this to `true` only on accounts that already had it enabled.
  - `automatic_failover_enabled` - (Optional) Whether automatic failover is enabled. Default is false.
  - `local_authentication_disabled` - (Optional) Whether local authentication is disabled. Default is true.
  - `partition_merge_enabled` - (Optional) Whether partition merge is enabled. Default is false.
  - `multiple_write_locations_enabled` - (Optional) Whether multiple write locations are enabled. Default is false.
  - `analytical_storage_config` - (Optional) Analytical storage configuration.
    - `schema_type` - The schema type for analytical storage.
  - `consistency_policy` - (Optional) Consistency policy configuration.
    - `max_interval_in_seconds` - (Optional) Maximum staleness interval in seconds. Default is 300.
    - `max_staleness_prefix` - (Optional) Maximum staleness prefix. Default is 100001.
    - `consistency_level` - (Optional) The consistency level. Default is "Session".
  - `backup` - (Optional) Backup configuration.
    - `retention_in_hours` - (Optional) Backup retention in hours.
    - `interval_in_minutes` - (Optional) Backup interval in minutes.
    - `storage_redundancy` - (Optional) Storage redundancy for backups.
    - `type` - (Optional) The backup type.
    - `tier` - (Optional) The backup tier.
  - `capabilities` - (Optional) Set of capabilities to enable on the Cosmos DB account.
    - `name` - The name of the capability.
  - `capacity` - (Optional) Capacity configuration.
    - `total_throughput_limit` - (Optional) Total throughput limit. Default is -1 (unlimited).
  - `cors_rule` - (Optional) CORS rule configuration.
    - `allowed_headers` - Set of allowed headers.
    - `allowed_methods` - Set of allowed HTTP methods.
    - `allowed_origins` - Set of allowed origins.
    - `exposed_headers` - Set of exposed headers.
    - `max_age_in_seconds` - (Optional) Maximum age in seconds for CORS.
  - `role_assignments` - (Optional) Map of role assignments to create on the Cosmos DB account. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    - `role_definition_id_or_name` - The role definition ID or name to assign.
    - `principal_id` - The principal ID to assign the role to.
    - `description` - (Optional) Description of the role assignment.
    - `skip_service_principal_aad_check` - (Optional) Whether to skip AAD check for service principal.
    - `condition` - (Optional) Condition for the role assignment.
    - `condition_version` - (Optional) Version of the condition.
    - `delegated_managed_identity_resource_id` - (Optional) Resource ID of the delegated managed identity.
    - `principal_type` - (Optional) Type of the principal (User, Group, ServicePrincipal).
  - `tags` - (Optional) Map of tags to assign to the Cosmos DB account.

Type:

```hcl
map(object({
    existing_resource_id         = optional(string, null)
    private_dns_zone_resource_id = optional(string, null)
    diagnostic_settings = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    name = optional(string)
    secondary_regions = optional(list(object({
      location          = string
      zone_redundant    = optional(bool, true)
      failover_priority = optional(number, 0)
    })), [])
    public_network_access_enabled    = optional(bool, false)
    analytical_storage_enabled       = optional(bool, false)
    automatic_failover_enabled       = optional(bool, true)
    local_authentication_disabled    = optional(bool, true)
    partition_merge_enabled          = optional(bool, false)
    multiple_write_locations_enabled = optional(bool, false)
    analytical_storage_config = optional(object({
      schema_type = string
    }), null)
    consistency_policy = optional(object({
      max_interval_in_seconds = optional(number, 300)
      max_staleness_prefix    = optional(number, 100001)
      consistency_level       = optional(string, "Session")
    }), {})
    backup = optional(object({
      retention_in_hours  = optional(number)
      interval_in_minutes = optional(number)
      storage_redundancy  = optional(string)
      type                = optional(string)
      tier                = optional(string)
    }), {})
    capabilities = optional(set(object({
      name = string
    })), [])
    capacity = optional(object({
      total_throughput_limit = optional(number, -1)
    }), {})
    cors_rule = optional(object({
      allowed_headers    = set(string)
      allowed_methods    = set(string)
      allowed_origins    = set(string)
      exposed_headers    = set(string)
      max_age_in_seconds = optional(number, null)
    }), null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    tags = optional(map(string), {})
  }))
```

Default: `{}`

### <a name="input_create_byor"></a> [create\_byor](#input\_create\_byor)

Description: Whether to create resources such as AI Search, Cosmos DB, Key Vault, and Storage Account in this deployment. If set to false, these resources will not be created or linked, and the module will only create the AI Foundry account and project.

Type: `bool`

Default: `false`

### <a name="input_create_private_endpoints"></a> [create\_private\_endpoints](#input\_create\_private\_endpoints)

Description: Whether to create private endpoints for AI Foundry, Cosmos DB, Key Vault, and AI Search. If set to false, private endpoints will not be created.

Type: `bool`

Default: `false`

### <a name="input_diagnostic_settings"></a> [diagnostic\_settings](#input\_diagnostic\_settings)

Description: A map of diagnostic settings to create on the AI Foundry account (Cognitive Services account). The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

- `name` - (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
- `log_categories` - (Optional) A set of log categories to send to the log analytics workspace. Defaults to `[]`.
- `log_groups` - (Optional) A set of log groups to send to the log analytics workspace. Defaults to `["allLogs"]`.
- `metric_categories` - (Optional) A set of metric categories to send to the log analytics workspace. Defaults to `["AllMetrics"]`.
- `log_analytics_destination_type` - (Optional) The destination type for the diagnostic setting. Possible values are `Dedicated` and `AzureDiagnostics`. Defaults to `Dedicated`.
- `workspace_resource_id` - (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
- `storage_account_resource_id` - (Optional) The resource ID of the storage account to send logs and metrics to.
- `event_hub_authorization_rule_resource_id` - (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
- `event_hub_name` - (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
- `marketplace_partner_resource_id` - (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.

Type:

```hcl
map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))
```

Default: `{}`

### <a name="input_enable_telemetry"></a> [enable\_telemetry](#input\_enable\_telemetry)

Description: This variable controls whether or not telemetry is enabled for the module.  
For more information see <https://aka.ms/avm/telemetryinfo>.  
If it is set to false, then no telemetry will be collected.

Type: `bool`

Default: `true`

### <a name="input_key_vault_definition"></a> [key\_vault\_definition](#input\_key\_vault\_definition)

Description: Configuration object for the Azure Key Vault to be created for GenAI services.

- `map key` - The key for the map entry. This key should match the AI project key when creating multiple projects with multiple Key Vaults. This can be used in naming, so short alphanumeric keys are required to avoid hitting naming length limits for the Key Vault when using the base name naming option.
  - `existing_resource_id` - (Optional) The resource ID of an existing Key Vault to use. If provided, the vault will not be created and the other inputs will be ignored.
  - `name` - (Optional) The name of the Key Vault. If not provided, a name will be generated.
  - `private_dns_zone_resource_id` - (Optional) The resource ID of the existing private DNS zone for Key Vault. If not provided or set to null, no DNS zone group will be created.
  - `diagnostic_settings` - (Optional) A map of diagnostic settings to create. Each entry follows the AVM diagnostic\_settings interface.
  - `sku` - (Optional) The SKU of the Key Vault. Default is "standard".
  - `tenant_id` - (Optional) The tenant ID for the Key Vault. If not provided, the current tenant will be used.
  - `role_assignments` - (Optional) Map of role assignments to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    - `role_definition_id_or_name` - The role definition ID or name to assign.
    - `principal_id` - The principal ID to assign the role to.
    - `description` - (Optional) Description of the role assignment.
    - `skip_service_principal_aad_check` - (Optional) Whether to skip AAD check for service principal.
    - `condition` - (Optional) Condition for the role assignment.
    - `condition_version` - (Optional) Version of the condition.
    - `delegated_managed_identity_resource_id` - (Optional) Resource ID of the delegated managed identity.
    - `principal_type` - (Optional) Type of the principal (User, Group, ServicePrincipal).
  - `tags` - (Optional) Map of tags to assign to the Key Vault.

Type:

```hcl
map(object({
    existing_resource_id         = optional(string, null)
    name                         = optional(string)
    private_dns_zone_resource_id = optional(string, null)
    diagnostic_settings = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    sku       = optional(string, "standard")
    tenant_id = optional(string)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    tags = optional(map(string), {})
  }))
```

Default: `{}`

### <a name="input_private_endpoint_resource_group_location"></a> [private\_endpoint\_resource\_group\_location](#input\_private\_endpoint\_resource\_group\_location)

Description: (Optional) The resource group location for private endpoints.

Type: `string`

Default: `null`

### <a name="input_private_endpoint_resource_group_name"></a> [private\_endpoint\_resource\_group\_name](#input\_private\_endpoint\_resource\_group\_name)

Description: (Optional) The resource group name for private endpoints.

Type: `string`

Default: `null`

### <a name="input_private_endpoint_subnet_resource_id"></a> [private\_endpoint\_subnet\_resource\_id](#input\_private\_endpoint\_subnet\_resource\_id)

Description: (Optional) The subnet ID for private endpoints.

Type: `string`

Default: `null`

### <a name="input_private_endpoints_manage_dns_zone_groups"></a> [private\_endpoints\_manage\_dns\_zone\_groups](#input\_private\_endpoints\_manage\_dns\_zone\_groups)

Description: Whether to manage private DNS zone groups for the private endpoints created by this module. If set to false, the private DNS zone groups will not be defined or managed.

Type: `bool`

Default: `true`

### <a name="input_resource_names"></a> [resource\_names](#input\_resource\_names)

Description: Custom names for each resource. If not provided, names will be generated using base\_name or name.

Type:

```hcl
object({
    ai_agent_host                   = optional(string)
    ai_foundry                      = optional(string)
    ai_foundry_project              = optional(string)
    ai_foundry_project_display_name = optional(string)
  })
```

Default: `{}`

### <a name="input_storage_account_definition"></a> [storage\_account\_definition](#input\_storage\_account\_definition)

Description: Configuration object for the Azure Storage Account to be created for GenAI services.

- `map key` - The key for the map entry. This key should match the AI project key when creating multiple projects with multiple Storage Accounts. This can be used in naming, so short alphanumeric keys are required to avoid hitting naming length limits for the Storage Account when using the base name naming option.
  - `existing_resource_id` - (Optional) The resource ID of an existing Storage Account to use. If provided, the account will not be created and the other inputs will be ignored.
  - `diagnostic_settings_storage_account` - (Optional) A map of diagnostic settings to create on the storage account. Each entry follows the AVM diagnostic\_settings interface.
  - `name` - (Optional) The name of the Storage Account. If not provided, a name will be generated.
  - `account_kind` - (Optional) The kind of storage account. Default is "StorageV2".
  - `account_tier` - (Optional) The performance tier of the storage account. Default is "Standard".
  - `account_replication_type` - (Optional) The replication type for the storage account. Default is "ZRS".
  - `endpoints` - (Optional) Map of endpoint configurations to enable. Default includes blob endpoint.
    - `type` - The type of endpoint (e.g., "blob", "file", "queue", "table").
    - `private_dns_zone_resource_id` - (Optional) The resource ID of the existing private DNS zone for the endpoint. If not provided or set to null, no DNS zone group will be created.
  - `access_tier` - (Optional) The access tier for the storage account. Default is "Hot".
  - `shared_access_key_enabled` - (Optional) Whether shared access keys are enabled. Default is false.
  - `role_assignments` - (Optional) Map of role assignments to create on the Storage Account. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time.
    - `role_definition_id_or_name` - The role definition ID or name to assign.
    - `principal_id` - The principal ID to assign the role to.
    - `description` - (Optional) Description of the role assignment.
    - `skip_service_principal_aad_check` - (Optional) Whether to skip AAD check for service principal.
    - `condition` - (Optional) Condition for the role assignment.
    - `condition_version` - (Optional) Version of the condition.
    - `delegated_managed_identity_resource_id` - (Optional) Resource ID of the delegated managed identity.
    - `principal_type` - (Optional) Type of the principal (User, Group, ServicePrincipal).
  - `tags` - (Optional) Map of tags to assign to the Storage Account.

Type:

```hcl
map(object({
    existing_resource_id = optional(string, null)
    diagnostic_settings_storage_account = optional(map(object({
      name                                     = optional(string, null)
      log_categories                           = optional(set(string), [])
      log_groups                               = optional(set(string), ["allLogs"])
      metric_categories                        = optional(set(string), ["AllMetrics"])
      log_analytics_destination_type           = optional(string, "Dedicated")
      workspace_resource_id                    = optional(string, null)
      storage_account_resource_id              = optional(string, null)
      event_hub_authorization_rule_resource_id = optional(string, null)
      event_hub_name                           = optional(string, null)
      marketplace_partner_resource_id          = optional(string, null)
    })), {})
    name                     = optional(string, null)
    account_kind             = optional(string, "StorageV2")
    account_tier             = optional(string, "Standard")
    account_replication_type = optional(string, "ZRS")
    endpoints = optional(map(object({
      type                         = string
      private_dns_zone_resource_id = optional(string, null)
      })), {
      blob = {
        type = "blob"
      }
    })
    access_tier               = optional(string, "Hot")
    shared_access_key_enabled = optional(bool, false)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    tags = optional(map(string), {})

#TODO:
    # Implement subservice passthrough here
  }))
```

Default: `{}`

### <a name="input_tags"></a> [tags](#input\_tags)

Description: (Optional) Tags to be applied to all resources.

Type: `map(string)`

Default: `null`

## Outputs

The following outputs are exported:

### <a name="output_ai_agent_account_capability_host_id"></a> [ai\_agent\_account\_capability\_host\_id](#output\_ai\_agent\_account\_capability\_host\_id)

Description: The resource ID of the account-level AI agent capability host.

### <a name="output_ai_agent_service_id"></a> [ai\_agent\_service\_id](#output\_ai\_agent\_service\_id)

Description: The resource ID of the AI agent capability host.

### <a name="output_ai_foundry_encryption_status"></a> [ai\_foundry\_encryption\_status](#output\_ai\_foundry\_encryption\_status)

Description: The encryption configuration status of the AI Foundry account.

### <a name="output_ai_foundry_id"></a> [ai\_foundry\_id](#output\_ai\_foundry\_id)

Description: The resource ID of the AI Foundry account.

### <a name="output_ai_foundry_name"></a> [ai\_foundry\_name](#output\_ai\_foundry\_name)

Description: The name of the AI Foundry account.

### <a name="output_ai_foundry_project_id"></a> [ai\_foundry\_project\_id](#output\_ai\_foundry\_project\_id)

Description: The resource ID of the AI Foundry Project.

### <a name="output_ai_foundry_project_internal_id"></a> [ai\_foundry\_project\_internal\_id](#output\_ai\_foundry\_project\_internal\_id)

Description: The internal ID of the AI Foundry project used for container naming.

### <a name="output_ai_foundry_project_name"></a> [ai\_foundry\_project\_name](#output\_ai\_foundry\_project\_name)

Description: The name of the AI Foundry Project.

### <a name="output_ai_foundry_project_system_identity_principal_id"></a> [ai\_foundry\_project\_system\_identity\_principal\_id](#output\_ai\_foundry\_project\_system\_identity\_principal\_id)

Description: The principal ID of the AI Foundry project's system-assigned managed identity.

### <a name="output_ai_model_deployment_ids"></a> [ai\_model\_deployment\_ids](#output\_ai\_model\_deployment\_ids)

Description: The resource IDs of all AI model deployments.

### <a name="output_ai_search_id"></a> [ai\_search\_id](#output\_ai\_search\_id)

Description: The resource ID of the AI Search service.

### <a name="output_ai_search_name"></a> [ai\_search\_name](#output\_ai\_search\_name)

Description: The name of the AI Search service.

### <a name="output_cosmos_db_id"></a> [cosmos\_db\_id](#output\_cosmos\_db\_id)

Description: The resource ID of the Cosmos DB account.

### <a name="output_cosmos_db_name"></a> [cosmos\_db\_name](#output\_cosmos\_db\_name)

Description: The name of the Cosmos DB account.

### <a name="output_key_vault_id"></a> [key\_vault\_id](#output\_key\_vault\_id)

Description: The resource ID of the Key Vault.

### <a name="output_key_vault_name"></a> [key\_vault\_name](#output\_key\_vault\_name)

Description: The name of the Key Vault.

### <a name="output_project_id_guid"></a> [project\_id\_guid](#output\_project\_id\_guid)

Description: The project ID formatted as GUID for container naming (only available when AI agent service is enabled).

### <a name="output_resource_group_id"></a> [resource\_group\_id](#output\_resource\_group\_id)

Description: The resource ID of the resource group.

### <a name="output_resource_group_name"></a> [resource\_group\_name](#output\_resource\_group\_name)

Description: The name of the resource group.

### <a name="output_resource_id"></a> [resource\_id](#output\_resource\_id)

Description: The resource IDs of the AI Foundry resource.

### <a name="output_storage_account_id"></a> [storage\_account\_id](#output\_storage\_account\_id)

Description: The resource ID of the storage account.

### <a name="output_storage_account_name"></a> [storage\_account\_name](#output\_storage\_account\_name)

Description: The name of the storage account.

## Modules

The following Modules are called:

### <a name="module_ai_foundry_project"></a> [ai\_foundry\_project](#module\_ai\_foundry\_project)

Source: ./modules/ai-foundry-project

Version:

### <a name="module_avm_utl_regions"></a> [avm\_utl\_regions](#module\_avm\_utl\_regions)

Source: Azure/avm-utl-regions/azurerm

Version: 0.12.0

### <a name="module_cosmosdb"></a> [cosmosdb](#module\_cosmosdb)

Source: Azure/avm-res-documentdb-databaseaccount/azurerm

Version: 0.10.0

### <a name="module_key_vault"></a> [key\_vault](#module\_key\_vault)

Source: Azure/avm-res-keyvault-vault/azurerm

Version: 0.10.2

### <a name="module_storage_account"></a> [storage\_account](#module\_storage\_account)

Source: Azure/avm-res-storage-storageaccount/azurerm

Version: 0.6.9

## Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

terraform-azurerm-avm-ptn-aiml-ai-foundry

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README