Skip to content

Commit 3648a94

Browse files
Abdul-MicrosoftAbdul-Microsoft
committed
refactor: remove Azure AI Search API key references and switch to AAD authentication
1 parent 1eed442 commit 3648a94

3 files changed

Lines changed: 37 additions & 94 deletions

File tree

‎infra/main.bicep‎

Lines changed: 3 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1330,10 +1330,6 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
13301330
name: 'SUPPORTED_MODELS'
13311331
value: '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
13321332
}
1333-
{
1334-
name: 'AZURE_AI_SEARCH_API_KEY'
1335-
secretRef: 'azure-ai-search-api-key'
1336-
}
13371333
{
13381334
name: 'AZURE_STORAGE_BLOB_URL'
13391335
value: avmStorageAccount.outputs.serviceEndpoints.blob
@@ -1369,13 +1365,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
13691365
]
13701366
}
13711367
]
1372-
secrets: [
1373-
{
1374-
name: 'azure-ai-search-api-key'
1375-
keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
1376-
identity: userAssignedIdentity.outputs.resourceId
1377-
}
1378-
]
1368+
secrets: []
13791369
}
13801370
}
13811371

@@ -1675,12 +1665,7 @@ module searchServiceUpdate 'br/public:avm/res/search/search-service:0.11.1' = {
16751665
name: take('avm.res.search.update.${solutionSuffix}', 64)
16761666
params: {
16771667
name: searchServiceName
1678-
authOptions: {
1679-
aadOrApiKey: {
1680-
aadAuthFailureMode: 'http401WithBearerChallenge'
1681-
}
1682-
}
1683-
disableLocalAuth: false
1668+
disableLocalAuth: true
16841669
hostingMode: 'default'
16851670
managedIdentities: {
16861671
systemAssigned: true
@@ -1809,12 +1794,7 @@ module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
18091794
roleDefinitionIdOrName: 'Key Vault Administrator'
18101795
}
18111796
]
1812-
secrets: [
1813-
{
1814-
name: 'AzureAISearchAPIKey'
1815-
value: searchService.listAdminKeys().primaryKey
1816-
}
1817-
]
1797+
secrets: []
18181798
enableTelemetry: enableTelemetry
18191799
}
18201800
}
@@ -1864,7 +1844,6 @@ output REASONING_MODEL_NAME string = aiFoundryAiServicesReasoningModelDeployment
18641844
output MCP_SERVER_NAME string = 'MacaeMcpServer'
18651845
output MCP_SERVER_DESCRIPTION string = 'MCP server with greeting, HR, and planning tools'
18661846
output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
1867-
output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'
18681847
output BACKEND_URL string = 'https://${containerApp.outputs.fqdn}'
18691848
output AZURE_AI_PROJECT_ENDPOINT string = aiFoundryAiProjectEndpoint
18701849
output AZURE_AI_AGENT_ENDPOINT string = aiFoundryAiProjectEndpoint

‎infra/main.json‎

Lines changed: 32 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.40.2.10011",
9-
"templateHash": "16839096090855786967"
9+
"templateHash": "17476534152468179054"
1010
},
1111
"name": "Multi-Agent Custom Automation Engine",
12-
"description": "This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.\n\n> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.\n"
12+
"description": "This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.\r\n\r\n> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.\r\n"
1313
},
1414
"parameters": {
1515
"solutionName": {
@@ -25441,8 +25441,8 @@
2544125441
},
2544225442
"dependsOn": [
2544325443
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
25444-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
2544525444
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
25445+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
2544625446
"logAnalyticsWorkspace",
2544725447
"userAssignedIdentity",
2544825448
"virtualNetwork"
@@ -30521,10 +30521,6 @@
3052130521
"name": "SUPPORTED_MODELS",
3052230522
"value": "[[\"o3\",\"o4-mini\",\"gpt-4.1\",\"gpt-4.1-mini\"]"
3052330523
},
30524-
{
30525-
"name": "AZURE_AI_SEARCH_API_KEY",
30526-
"secretRef": "azure-ai-search-api-key"
30527-
},
3052830524
{
3052930525
"name": "AZURE_STORAGE_BLOB_URL",
3053030526
"value": "[reference('avmStorageAccount').outputs.serviceEndpoints.value.blob]"
@@ -30562,13 +30558,7 @@
3056230558
]
3056330559
},
3056430560
"secrets": {
30565-
"value": [
30566-
{
30567-
"name": "azure-ai-search-api-key",
30568-
"keyVaultUrl": "[reference('keyvault').outputs.secrets.value[0].uriWithVersion]",
30569-
"identity": "[reference('userAssignedIdentity').outputs.resourceId.value]"
30570-
}
30571-
]
30561+
"value": []
3057230562
}
3057330563
},
3057430564
"template": {
@@ -32140,7 +32130,6 @@
3214032130
"containerAppEnvironment",
3214132131
"containerAppMcp",
3214232132
"existingAiFoundryAiServicesProject",
32143-
"keyvault",
3214432133
"searchServiceUpdate",
3214532134
"userAssignedIdentity"
3214632135
]
@@ -42268,15 +42257,8 @@
4226842257
"name": {
4226942258
"value": "[variables('searchServiceName')]"
4227042259
},
42271-
"authOptions": {
42272-
"value": {
42273-
"aadOrApiKey": {
42274-
"aadAuthFailureMode": "http401WithBearerChallenge"
42275-
}
42276-
}
42277-
},
4227842260
"disableLocalAuth": {
42279-
"value": false
42261+
"value": true
4228042262
},
4228142263
"hostingMode": {
4228242264
"value": "default"
@@ -44654,9 +44636,6 @@
4465444636
},
4465544637
"searchServiceName": {
4465644638
"value": "[variables('searchServiceName')]"
44657-
},
44658-
"searchApiKey": {
44659-
"value": "[listAdminKeys('searchService', '2024-06-01-preview').primaryKey]"
4466044639
}
4466144640
},
4466244641
"template": {
@@ -44666,30 +44645,45 @@
4466644645
"_generator": {
4466744646
"name": "bicep",
4466844647
"version": "0.40.2.10011",
44669-
"templateHash": "14874963049736669838"
44648+
"templateHash": "15348022841521786626"
4467044649
}
4467144650
},
4467244651
"parameters": {
4467344652
"aifSearchConnectionName": {
44674-
"type": "string"
44653+
"type": "string",
44654+
"metadata": {
44655+
"description": "Name of the AI Foundry search connection"
44656+
}
4467544657
},
4467644658
"searchServiceName": {
44677-
"type": "string"
44659+
"type": "string",
44660+
"metadata": {
44661+
"description": "Name of the Azure AI Search service"
44662+
}
4467844663
},
4467944664
"searchServiceResourceId": {
44680-
"type": "string"
44665+
"type": "string",
44666+
"metadata": {
44667+
"description": "Resource ID of the Azure AI Search service"
44668+
}
4468144669
},
4468244670
"searchServiceLocation": {
44683-
"type": "string"
44671+
"type": "string",
44672+
"metadata": {
44673+
"description": "Location/region of the Azure AI Search service"
44674+
}
4468444675
},
4468544676
"aiFoundryName": {
44686-
"type": "string"
44677+
"type": "string",
44678+
"metadata": {
44679+
"description": "Name of the AI Foundry account"
44680+
}
4468744681
},
4468844682
"aiFoundryProjectName": {
44689-
"type": "string"
44690-
},
44691-
"searchApiKey": {
44692-
"type": "securestring"
44683+
"type": "string",
44684+
"metadata": {
44685+
"description": "Name of the AI Foundry project"
44686+
}
4469344687
}
4469444688
},
4469544689
"resources": [
@@ -44700,10 +44694,7 @@
4470044694
"properties": {
4470144695
"category": "CognitiveSearch",
4470244696
"target": "[format('https://{0}.search.windows.net', parameters('searchServiceName'))]",
44703-
"authType": "ApiKey",
44704-
"credentials": {
44705-
"key": "[parameters('searchApiKey')]"
44706-
},
44697+
"authType": "AAD",
4470744698
"isSharedToAll": true,
4470844699
"metadata": {
4470944700
"ApiType": "Azure",
@@ -44777,12 +44768,7 @@
4477744768
]
4477844769
},
4477944770
"secrets": {
44780-
"value": [
44781-
{
44782-
"name": "AzureAISearchAPIKey",
44783-
"value": "[listAdminKeys('searchService', '2024-06-01-preview').primaryKey]"
44784-
}
44785-
]
44771+
"value": []
4478644772
},
4478744773
"enableTelemetry": {
4478844774
"value": "[parameters('enableTelemetry')]"
@@ -47908,7 +47894,6 @@
4790847894
"dependsOn": [
4790947895
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').keyVault)]",
4791047896
"logAnalyticsWorkspace",
47911-
"searchService",
4791247897
"userAssignedIdentity",
4791347898
"virtualNetwork"
4791447899
]
@@ -48041,10 +48026,6 @@
4804148026
"type": "string",
4804248027
"value": "[[\"o3\",\"o4-mini\",\"gpt-4.1\",\"gpt-4.1-mini\"]"
4804348028
},
48044-
"AZURE_AI_SEARCH_API_KEY": {
48045-
"type": "string",
48046-
"value": "<Deployed-Search-ApiKey>"
48047-
},
4804848029
"BACKEND_URL": {
4804948030
"type": "string",
4805048031
"value": "[format('https://{0}', reference('containerApp').outputs.fqdn.value)]"

‎infra/main_custom.bicep‎

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1365,10 +1365,6 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
13651365
name: 'SUPPORTED_MODELS'
13661366
value: '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
13671367
}
1368-
{
1369-
name: 'AZURE_AI_SEARCH_API_KEY'
1370-
secretRef: 'azure-ai-search-api-key'
1371-
}
13721368
{
13731369
name: 'AZURE_STORAGE_BLOB_URL'
13741370
value: avmStorageAccount.outputs.serviceEndpoints.blob
@@ -1412,13 +1408,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
14121408
]
14131409
}
14141410
]
1415-
secrets: [
1416-
{
1417-
name: 'azure-ai-search-api-key'
1418-
keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
1419-
identity: userAssignedIdentity.outputs.resourceId
1420-
}
1421-
]
1411+
secrets: []
14221412
}
14231413
}
14241414

@@ -1801,7 +1791,6 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
18011791
searchServiceResourceId: searchService.outputs.resourceId
18021792
searchServiceLocation: searchService.outputs.location
18031793
searchServiceName: searchService.outputs.name
1804-
searchApiKey: searchService.outputs.primaryKey
18051794
}
18061795
dependsOn: [
18071796
aiFoundryAiServices
@@ -1852,12 +1841,7 @@ module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
18521841
roleDefinitionIdOrName: 'Key Vault Administrator'
18531842
}
18541843
]
1855-
secrets: [
1856-
{
1857-
name: 'AzureAISearchAPIKey'
1858-
value: searchService.outputs.primaryKey
1859-
}
1860-
]
1844+
secrets: []
18611845
enableTelemetry: enableTelemetry
18621846
}
18631847
}
@@ -1908,7 +1892,6 @@ output REASONING_MODEL_NAME string = aiFoundryAiServicesReasoningModelDeployment
19081892
output MCP_SERVER_NAME string = 'MacaeMcpServer'
19091893
output MCP_SERVER_DESCRIPTION string = 'MCP server with greeting, HR, and planning tools'
19101894
output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
1911-
output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'
19121895
output BACKEND_URL string = 'https://${containerApp.outputs.fqdn}'
19131896
output AZURE_AI_PROJECT_ENDPOINT string = aiFoundryAiProjectEndpoint
19141897
output AZURE_AI_AGENT_ENDPOINT string = aiFoundryAiProjectEndpoint

0 commit comments

Comments
 (0)