Skip to content

Commit 48e8a62

Browse files
Merge pull request #144 from microsoft/gaiye-avm-waf
feat: AI Foundy code private end point working and tested
2 parents adc2f6a + b5dd365 commit 48e8a62

18 files changed

Lines changed: 1610 additions & 828 deletions

README.md

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ The Modernize your code solution accelerator allows users to specify a group of
88
<br/>
99

1010
<div align="center">
11-
11+
1212
[**SOLUTION OVERVIEW**](#solution-overview) \| [**QUICK DEPLOY**](#quick-deploy) \| [**BUSINESS SCENARIO**](#business-scenario) \| [**SUPPORTING DOCUMENTATION**](#supporting-documentation)
1313

1414
</div>
@@ -24,7 +24,10 @@ The solution leverages Azure AI Foundry, Azure OpenAI Service, Azure Container A
2424
|![image](./docs/images/read_me/solArchitecture.png)|
2525
|---|
2626

27+
This architecture will be deployed with the 'sandbox' setting of our deployment process. Optionally you can deploy [Well-Architected Framework (WAF) aligned](https://learn.microsoft.com/en-us/azure/well-architected/) architecture, described in [WAF-Aligned Solution Architecture](./docs/ArchitectureWAF.md), with the WAF-Aligned deployment option described in [Deployment Guide](./docs/DeploymentGuide.md).
28+
2729
### Agentic architecture
30+
2831
|![image](./docs/images/read_me/agentArchitecture.png)|
2932
|---|
3033

@@ -51,16 +54,16 @@ If you'd like to customize the solution accelerator, here are some common areas
5154
<summary>Click to learn more about the key features this solution enables</summary>
5255

5356
- **Code language modernization** <br/>
54-
Modernizing outdated code ensures compatibility with current technologies, reduces reliance on legacy expertise, and keeps businesses competitive.
57+
Modernizing outdated code ensures compatibility with current technologies, reduces reliance on legacy expertise, and keeps businesses competitive.
5558

5659
- **Summary and review of new code** <br/>
57-
Generating summaries and translating code files keeps humans in the loop, enhances their understanding, and facilitates timely interventions, ensuring the files are ready to export.
60+
Generating summaries and translating code files keeps humans in the loop, enhances their understanding, and facilitates timely interventions, ensuring the files are ready to export.
5861

5962
- **Business logic analysis** <br/>
60-
Leveraging AI to decipher business logic from legacy code helps minimizes the risk of human error.
63+
Leveraging AI to decipher business logic from legacy code helps minimizes the risk of human error.
6164

6265
- **Efficient code transformation** <br/>
63-
Streamlining the process of analyzing, converting, and iterative error testing reduces time and effort required to modernize the systems.
66+
Streamlining the process of analyzing, converting, and iterative error testing reduces time and effort required to modernize the systems.
6467

6568
</details>
6669

@@ -77,7 +80,7 @@ Follow the quick deploy steps on the deployment guide to deploy this solution to
7780

7881
| [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/microsoft/Modernize-your-Code-Solution-Accelerator) | [![Open in Dev Containers](https://img.shields.io/static/v1?style=for-the-badge&label=Dev%20Containers&message=Open&color=blue&logo=visualstudiocode)](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/microsoft/Modernize-your-Code-Solution-Accelerator) |
7982
|---|---|
80-
83+
8184
<br/>
8285

8386
> ⚠️ **Important: Check Azure OpenAI Quota Availability**
@@ -141,19 +144,19 @@ The sample data used in this repository is synthetic and generated using Azure O
141144
<summary>Click to learn more about what value this solution provides</summary>
142145

143146
- **Accelerated Migration** <br/>
144-
Automate the translation of SQL queries, significantly reducing migration time and effort.
147+
Automate the translation of SQL queries, significantly reducing migration time and effort.
145148

146149
- **Error Reduction** <br/>
147-
Multi-agent validation ensures accurate translations and maintains data integrity.
150+
Multi-agent validation ensures accurate translations and maintains data integrity.
148151

149152
- **Knowledge Preservation** <br/>
150-
Captures and preserves business logic during the modernization process.
153+
Captures and preserves business logic during the modernization process.
151154

152155
- **Cost Efficiency** <br/>
153-
Reduces reliance on specialized legacy system expertise and manual translation efforts.
156+
Reduces reliance on specialized legacy system expertise and manual translation efforts.
154157

155158
- **Standardization** <br/>
156-
Ensures consistent query translation across the organization.
159+
Ensures consistent query translation across the organization.
157160

158161
</details>
159162

docs/ArchitectureWAF.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Azure WAF-Aligned Architecture
2+
3+
This architecture implements [Azure Well-Architected Framework (WAF)](https://learn.microsoft.com/en-us/azure/well-architected/) principles for enterprise-grade deployments, deployed with the WAF-Aligned deployment option:
4+
5+
![WAF-Aligned Architecture Diagram](../docs/images/read_me/solArchitectureWAF.png)
6+
7+
## WAF Pillars Implementation
8+
9+
### Security
10+
- **Zero Trust Network:** Private VNet with private endpoints for all PaaS services
11+
- **Identity & Access:** Managed identities with RBAC and least-privilege access
12+
- **Secure Admin Access:** Azure Bastion + Jumpbox for internal administration
13+
- **Secrets Management:** Azure Key Vault integration
14+
15+
### Operational Excellence
16+
- **Observability:** Centralized logging via Log Analytics Workspace
17+
- **Application Monitoring:** Application Insights for telemetry and diagnostics
18+
- **Infrastructure as Code:** Bicep templates with parameterized configurations
19+
20+
### Performance Efficiency
21+
- **Auto-scaling:** Container Apps with configurable scaling policies
22+
- **Regional Proximity:** Resources deployed in optimal Azure regions
23+
24+
### Cost Optimization
25+
- **Right-sizing:** Parameterized SKUs and capacity settings
26+
- **Resource Sharing:** Shared networking and monitoring infrastructure
27+
28+
### Reliability
29+
- **High Availability:** Multi-zone deployment options
30+
- **Data Redundancy:** Configurable geo-replication for critical data stores
31+
- **Private Connectivity:** Eliminates internet dependencies
32+
33+
## Core Architecture Components
34+
35+
| Component | Purpose | WAF Alignment |
36+
|-----------|---------|---------------|
37+
| **Virtual Network** | Network isolation boundary | Security, Reliability |
38+
| **Private Endpoints** | Secure PaaS connectivity (AI Services, Storage, Cosmos DB, Key Vault) | Security |
39+
| **Private DNS Zones** | Internal name resolution | Security, Reliability |
40+
| **Azure Bastion + Jumpbox** | Secure administrative access | Security |
41+
| **Container Apps** | Application hosting with VNet integration | Performance, Reliability |
42+
| **Log Analytics + App Insights** | Centralized monitoring and diagnostics | Operational Excellence |
43+
44+
## Deployment Configuration
45+
- **Parameter File:** `infra/main.waf-aligned.bicepparam` - Controls all WAF features
46+
- **Network-first Design:** All components deployed within private network boundaries
47+
- **Enterprise-ready:** Production-grade security and monitoring enabled
48+
49+
## Application Information Flow
50+
51+
The application information flow remains the same for both 'sandbox' and 'waf-aligned' configuration.
52+
53+
The solution is composed of several services:
54+
55+
- The web app front end and the backend app logic are containerized and run from Azure Container service instances.
56+
- When a request for conversion is created in the web app admin console, the user specifies what files should be converted and the target SQL dialect for conversion.
57+
- These files are then uploaded to blob storage and initial data about the request is stored in Cosmos DB.
58+
- The conversion takes place using appropriate LLM models using multiple agents, with each agent having a dedicated purpose in the conversion process. As files are converted, they are placed into blob storage, with metadata collected into Cosmos detailing the conversion process and the current state of the batch.
59+
- Cosmos also stores the logs from the individual agents so the results can be fully reviewed before any of the converted files are put into production.

docs/CmsaArchitectureSource.pptx

352 KB
Binary file not shown.

docs/DeploymentGuide.md

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,15 @@ Here are some example regions where the services are available: East US, East US
1818

1919
| [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/microsoft/Modernize-your-Code-Solution-Accelerator) | [![Open in Dev Containers](https://img.shields.io/static/v1?style=for-the-badge&label=Dev%20Containers&message=Open&color=blue&logo=visualstudiocode)](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/microsoft/Modernize-your-Code-Solution-Accelerator) |
2020
|---|---|
21-
21+
2222
### **Configurable Deployment Settings**
2323

2424
When you start the deployment, most parameters will have **default values**, but you can update the following settings by following the steps [here](../docs/CustomizingAzdParameters.md):
2525

2626
| **Setting** | **Description** | **Default value** |
2727
|------------|----------------| ------------|
28-
| **Azure Region** | The region where resources will be created. | East US|
29-
| **Resource Prefix** | Prefix for all resources created by this template. This prefix will be used to create unique names for all resources. The prefix must be unique within the resource group. | None |
30-
| **AI Location** | Location for all AI services resources. This location can be different from the resource group location | None |
28+
| **Azure Region** | The region where resources will be created. | None |
29+
| **SolutionName** | Text/String used for part of all resources created by this template. | None |
3130
| **Capacity** | Configure capacity for **gpt-4o**. | 5k |
3231

3332
This accelerator can be configured to use authentication.
@@ -42,7 +41,29 @@ By default, the **GPT model capacity** in deployment is set to **5k tokens**.
4241
4342
To adjust quota settings, follow these [steps](../docs/AzureGPTQuotaSettings.md)
4443

45-
### Deployment Options
44+
### Deployment Options & Steps
45+
### Sandbox or WAF Aligned Deployment Options
46+
47+
The [`infra`](../infra) folder contains the [`main.bicep`](../infra/main.bicep) Bicep script, which defines all Azure infrastructure components for this solution.
48+
49+
By default, the `azd up` command uses the [`main.bicepparam`](../infra/main.bicepparam) file to deploy the solution. This file is pre-configured for a **sandbox environment** — ideal for development and proof-of-concept scenarios, with minimal security and cost controls for rapid iteration.
50+
51+
For **production deployments**, the repository also provides [`main.waf-aligned.bicepparam`](../infra/main.waf-aligned.bicepparam), which applies a [WAF-aligned](https://learn.microsoft.com/en-us/azure/well-architected/) configuration. This option enables additional Azure best practices for reliability, security, cost optimization, operational excellence, and performance efficiency, such as:
52+
53+
- Enhanced network security (e.g., Network protection with private endpoints)
54+
- Stricter access controls and managed identities
55+
- Logging, monitoring, and diagnostics enabled by default
56+
- Resource tagging and cost management recommendations
57+
58+
**How to choose your deployment configuration:**
59+
60+
- Use the default [`main.bicepparam`](../infra/main.bicepparam) for a sandbox/dev environment.
61+
- For a WAF-aligned, production-ready deployment, copy the contents of [`main.waf-aligned.bicepparam`](../infra/main.waf-aligned.bicepparam) into `main.bicepparam` before running `azd up`.
62+
63+
> [!TIP]
64+
> Always review and adjust parameter values (such as region, capacity, security settings and log analytics workspace configuration) to match your organization’s requirements before deploying. For production, ensure you have sufficient quota and follow the principle of least privilege for all identities and role assignments.
65+
66+
4667
Pick from the options below to see step-by-step instructions for: GitHub Codespaces, VS Code Dev Containers, Local Environments, and Bicep deployments.
4768

4869
<details>
@@ -114,23 +135,28 @@ To change the azd parameters from the default values, follow the steps [here](..
114135
115136
1. Login to Azure:
116137
117-
```shell
118-
azd auth login
119-
```
138+
```shell
139+
azd auth login
140+
```
141+
142+
#### Note: To authenticate with Azure Developer CLI (`azd`) to a specific tenant, use the previous command with your **Tenant ID**:
143+
144+
```sh
145+
azd auth login --tenant-id <tenant-id>
146+
```
120147
121-
#### Note: To authenticate with Azure Developer CLI (`azd`) to a specific tenant, use the previous command with your **Tenant ID**:
148+
2. Provide an `azd` environment name (like "cmsaapp")
122149
123-
```sh
124-
azd auth login --tenant-id <tenant-id>
150+
```sh
151+
azd env new <cmsaapp>
125152
```
126153
127-
2. Provision and deploy all the resources:
154+
3. Provision and deploy all the resources:
128155
129156
```shell
130157
azd up
131158
```
132159
133-
3. Provide an `azd` environment name (like "cmsaapp")
134160
4. Select a subscription from your Azure account, and select a location which has quota for all the resources.
135161
* This deployment will take *6-9 minutes* to provision the resources in your account and set up the solution with sample data.
136162
* If you get an error or timeout with deployment, changing the location can help, as there may be availability constraints for the resources.
235 KB
Loading

0 commit comments

Comments
 (0)