Skip to content

Commit 1d2ae57

Browse files
ryhudryhud
authored
Merge pull request microsoft#2 from ryhud/ryhud-301
Ryhud 301
2 parents 5808615 + 71b05cf commit 1d2ae57

8 files changed

Lines changed: 55 additions & 16 deletions

File tree

‎quickstart/201-machine-learning-moderately-secure/dsvm.tf‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,7 @@ resource "azurerm_network_interface" "dsvm" {
77
name = "configuration"
88
subnet_id = azurerm_subnet.snet-dsvm.id
99
private_ip_address_allocation = "Dynamic"
10-
}
11-
/*depends_on = [
12-
azurerm_route_table.jumphost_rt
13-
]
14-
*/
10+
}
1511
}
1612

1713
resource "azurerm_windows_virtual_machine" "dsvm" {

‎quickstart/201-machine-learning-moderately-secure/readme.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,15 @@ and its associated resources including Azure Key Vault, Azure Storage, Azure App
66
In addition to these core services, this configuration specifies any networking components that are required to set up Azure Machine Learning
77
for private network connectivity using [Azure Private Link](https://docs.microsoft.com/en-us/azure/private-link/).
88

9-
This configuration describes the minimal set of resources you require to get started with Azure Machine Learning in a network-isolated set-up. This configuration creates new network components. If you want to reuse existing network components, see [202 example](../201-machine-learning-moderately-secure/readme.md).
9+
This configuration describes the minimal set of resources you require to get started with Azure Machine Learning in a network-isolated set-up. This configuration creates new network components. Use Azure Bastion to securely connect to the Windows Data Science Virtual Machine. If you want to reuse existing network components, see [202 example](../201-machine-learning-moderately-secure/readme.md).
1010

1111
## Resources
1212

1313
| Terraform Resource Type | Description |
1414
| - | - |
1515
| `azurerm_resource_group` | The resource group all resources get deployed into |
16+
| `azurerm_bastion_host` | An Azure Bastion Instance to securely RDP/SSH into Virtual Machines deployed into the Virtual Network |
17+
| `azurerm_windows_virtual_machine` | A Windows Data Science Virtual Machine used for connecting to the Azure Machine Learning workspace |
1618
| `azurerm_application_insights` | An Azure Application Insights instance associated to the Azure Machine Learning workspace |
1719
| `azurerm_key_vault` | An Azure Key Vault instance associated to the Azure Machine Learning workspace |
1820
| `azurerm_storage_account` | An Azure Storage instance associated to the Azure Machine Learning workspace |
@@ -39,6 +41,9 @@ This configuration describes the minimal set of resources you require to get sta
3941
| aks_subnet_address_space | Address space of the aks subnet | ["10.0.2.0/23"] |
4042
| ml_subnet_address_space | Address space of the ML workspace subnet | ["10.0.0.0/24"] |
4143
| image_build_compute_name | Name of the compute cluster to be created and configured for building docker images (Azure ML Environments) | image-builder |
44+
| dsvm_name | Name of the Windows Data Science VM resource | vmdsvm01 |
45+
| dsvm_admin_username | Admin username of the Windows Data Science VM | azureadmin |
46+
| dsvm_host_password | Password for the admin username of the Data Science VM | - |
4247

4348

4449
## Usage

‎quickstart/201-machine-learning-moderately-secure/workspace.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,13 @@ resource "azurerm_machine_learning_workspace" "default" {
6363
# Args of use when using an Azure Private Link configuration
6464
public_network_access_enabled = false
6565
image_build_compute_name = var.image_build_compute_name
66+
depends_on = [
67+
azurerm_private_endpoint.kv_ple,
68+
azurerm_private_endpoint.st_ple_blob,
69+
azurerm_private_endpoint.storage_ple_file,
70+
azurerm_private_endpoint.cr_ple,
71+
azurerm_subnet.snet-training
72+
]
6673

6774
}
6875

‎quickstart/301-machine-learning-hub-spoke-secure/azure-firewall.tf‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
1-
1+
# Generate random string for unique firewall diagnostic name
2+
resource "random_string" "fw_diag_prefix" {
3+
length = 8
4+
upper = false
5+
special = false
6+
number = false
7+
}
28
resource "azurerm_ip_group" "ip_group_hub" {
39
name = "hub-ipgroup"
410
location = azurerm_resource_group.hub_rg.location
@@ -61,7 +67,7 @@ resource "azurerm_firewall" "azure_firewall_instance" {
6167
}
6268

6369
resource "azurerm_monitor_diagnostic_setting" "azure_firewall_instance" {
64-
name = "diagnostics-${var.name}-${var.environment}"
70+
name = "diagnostics-${var.name}-${var.environment}-${random_string.fw_diag_prefix.result}"
6571
target_resource_id = azurerm_firewall.azure_firewall_instance.id
6672
log_analytics_workspace_id = azurerm_log_analytics_workspace.default.id
6773

@@ -168,6 +174,20 @@ application_rule_collection {
168174
destination_fqdns = ["github.com"]
169175
}
170176

177+
rule {
178+
name = "raw.githubusercontent.com"
179+
protocols {
180+
type = "Https"
181+
port = 443
182+
}
183+
protocols {
184+
type = "Http"
185+
port = 80
186+
}
187+
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
188+
destination_fqdns = ["raw.githubusercontent.com"]
189+
}
190+
171191
rule {
172192
name = "microsoft-metrics-rules"
173193
protocols {

‎quickstart/301-machine-learning-hub-spoke-secure/dsvm.tf‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,7 @@ resource "azurerm_network_interface" "dsvm" {
77
name = "configuration"
88
subnet_id = azurerm_subnet.snet-jumphost.id
99
private_ip_address_allocation = "Dynamic"
10-
}
11-
/*depends_on = [
12-
azurerm_route_table.jumphost_rt
13-
]
14-
*/
10+
}
1511
}
1612

1713
resource "azurerm_windows_virtual_machine" "dsvm" {

‎quickstart/301-machine-learning-hub-spoke-secure/readme.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ This configuration describes the minimal set of resources you require to get sta
1313
| Terraform Resource Type | Description |
1414
| - | - |
1515
| `azurerm_resource_group` | The resource group all resources get deployed into |
16+
| `azurerm_bastion_host` | An Azure Bastion Instance to securely RDP/SSH into Virtual Machines deployed into the Virtual Network |
17+
| `azurerm_windows_virtual_machine` | A Windows Data Science Virtual Machine used for connecting to the Azure Machine Learning workspace |
1618
| `azurerm_application_insights` | An Azure Application Insights instance associated to the Azure Machine Learning workspace |
1719
| `azurerm_key_vault` | An Azure Key Vault instance associated to the Azure Machine Learning workspace |
1820
| `azurerm_storage_account` | An Azure Storage instance associated to the Azure Machine Learning workspace |
@@ -26,6 +28,8 @@ This configuration describes the minimal set of resources you require to get sta
2628
| `azurerm_machine_learning_compute_instance` | An Azure Machine Learning compute instance a single-node managed compute. |
2729
| `azurerm_machine_learning_compute_cluster` | An Azure Machine Learning compute cluster as multi-node shared and managed compute. |
2830
| `azurerm_network_security_group` | Network security group with required inbound and outbound rules for Azure Machine Learning. |
31+
| `azurerm_firewall` | An Azure firewall instance used for egress traffic on the Virtual Network. |
32+
| `azurerm_public_ip` | A public IP resource used for the Azure Firewall. |
2933

3034
## Variables
3135

@@ -38,8 +42,14 @@ This configuration describes the minimal set of resources you require to get sta
3842
| training_subnet_address_space | Address space of the training subnet | ["10.0.1.0/24"] |
3943
| aks_subnet_address_space | Address space of the aks subnet | ["10.0.2.0/23"] |
4044
| ml_subnet_address_space | Address space of the ML workspace subnet | ["10.0.0.0/24"] |
45+
| vnet_hub_address_space | Address space of the Hub virtual network | ["10.1.0.0/16"] |
46+
| jumphost_subnet_address_space | Address space of the Jumphost subnet | ["10.1.2.0/24"] |
47+
| bastion_subnet_address_space | Address space of the bastion subnet | ["10.1.3.0/24"] |
48+
| firewall_subnet_address_space | Address space of the Az Fiewall subnet | ["10.1.4.0/24"] |
4149
| image_build_compute_name | Name of the compute cluster to be created and configured for building docker images (Azure ML Environments) | image-builder |
42-
50+
| dsvm_name | Name of the Windows Data Science VM resource | vmdsvm01 |
51+
| dsvm_admin_username | Admin username of the Windows Data Science VM | azureadmin |
52+
| dsvm_host_password | Password for the admin username of the Data Science VM | - |
4353

4454
## Usage
4555

‎quickstart/301-machine-learning-hub-spoke-secure/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,5 +89,5 @@ variable "dsvm_admin_username" {
8989
variable "dsvm_host_password" {
9090
type = string
9191
description = "Password for the admin username of the Data Science VM"
92-
92+
sensitive = true
9393
}

‎quickstart/301-machine-learning-hub-spoke-secure/workspace.tf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,12 @@ resource "azurerm_machine_learning_workspace" "default" {
6565
public_network_access_enabled = false
6666
image_build_compute_name = var.image_build_compute_name
6767
depends_on = [
68-
azurerm_firewall.azure_firewall_instance
68+
azurerm_firewall.azure_firewall_instance,
69+
azurerm_private_endpoint.kv_ple,
70+
azurerm_private_endpoint.st_ple_blob,
71+
azurerm_private_endpoint.storage_ple_file,
72+
azurerm_private_endpoint.cr_ple,
73+
azurerm_subnet.snet-training
6974
]
7075

7176
}

0 commit comments

Comments
 (0)