Skip to content

Commit 1340ac6

Browse files
AjitPadhi-MicrosoftAjitPadhi-Microsoft
committed
waf changes with out dns in search
1 parent 4e78066 commit 1340ac6

3 files changed

Lines changed: 56 additions & 36 deletions

File tree

‎infra/main.bicep‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,13 @@ param tags resourceInput<'Microsoft.Resources/resourceGroups@2025-04-01'>.tags =
104104
param enableMonitoring bool = true
105105

106106
@description('Optional. Enable scalability for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
107-
param enableScalability bool = true
107+
param enableScalability bool = false
108108

109109
@description('Optional. Enable redundancy for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
110110
param enableRedundancy bool = false
111111

112112
@description('Optional. Enable private networking for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
113-
param enablePrivateNetworking bool = true
113+
param enablePrivateNetworking bool = false
114114

115115
@description('Optional. The Container Registry hostname where the docker images are located.')
116116
param acrName string = 'testapwaf'
@@ -200,6 +200,7 @@ resource resourceGroupTags 'Microsoft.Resources/tags@2021-04-01' = {
200200
tags: {
201201
... tags
202202
TemplateName: 'Docgen'
203+
SecurityControl: 'Ignore'
203204
}
204205
}
205206
}
@@ -680,6 +681,7 @@ module searchServiceToExistingAiServicesRoleAssignment 'modules/role-assignment.
680681
// ========== AI Foundry: AI Search ========== //
681682
var aiSearchName = 'srch-${solutionSuffix}'
682683
var aiSearchConnectionName = 'foundry-search-connection-${solutionSuffix}'
684+
var nenablePrivateNetworking = false
683685
module aiSearch 'br/public:avm/res/search/search-service:0.11.1' = {
684686
name: take('avm.res.cognitive-search-services.${aiSearchName}', 64)
685687
params: {
@@ -693,7 +695,7 @@ module aiSearch 'br/public:avm/res/search/search-service:0.11.1' = {
693695
diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
694696
disableLocalAuth: false
695697
hostingMode: 'default'
696-
sku: 'standard'
698+
sku: enableScalability ? 'standard' : 'basic'
697699
managedIdentities: { systemAssigned: true }
698700
networkRuleSet: {
699701
bypass: 'AzureServices'
@@ -725,8 +727,8 @@ module aiSearch 'br/public:avm/res/search/search-service:0.11.1' = {
725727
]
726728
semanticSearch: 'free'
727729
// WAF aligned configuration for Private Networking
728-
publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
729-
privateEndpoints: enablePrivateNetworking
730+
publicNetworkAccess: nenablePrivateNetworking ? 'Disabled' : 'Enabled'
731+
privateEndpoints: nenablePrivateNetworking
730732
? [
731733
{
732734
name: 'pep-${aiSearchName}'
@@ -736,8 +738,8 @@ module aiSearch 'br/public:avm/res/search/search-service:0.11.1' = {
736738
{ privateDnsZoneResourceId: avmPrivateDnsZones[dnsZoneIndex.searchService]!.outputs.resourceId }
737739
]
738740
}
739-
service: 'searchService'
740741
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
742+
service: 'searchService'
741743
}
742744
]
743745
: []
@@ -1189,7 +1191,7 @@ module webSite 'modules/web-sites.bicep' = {
11891191
}
11901192

11911193
// ========== App Service Logs Configuration ========== //
1192-
resource webSiteLogs 'Microsoft.Web/sites/config@2024-04-01' = {
1194+
resource webSiteLogs 'Microsoft.Web/sites/config@2024-04-01' = if (enableMonitoring) {
11931195
name: '${webSiteResourceName}/logs'
11941196
properties: {
11951197
applicationLogs: {

‎infra/main.json‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.37.4.10188",
9-
"templateHash": "14511270786246958386"
9+
"templateHash": "9632700957939419530"
1010
},
1111
"name": "Document Generation Solution Accelerator",
1212
"description": "CSA CTO Gold Standard Solution Accelerator for Document Generation.\n"
@@ -190,7 +190,7 @@
190190
},
191191
"enableScalability": {
192192
"type": "bool",
193-
"defaultValue": true,
193+
"defaultValue": false,
194194
"metadata": {
195195
"description": "Optional. Enable scalability for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
196196
}
@@ -204,7 +204,7 @@
204204
},
205205
"enablePrivateNetworking": {
206206
"type": "bool",
207-
"defaultValue": true,
207+
"defaultValue": false,
208208
"metadata": {
209209
"description": "Optional. Enable private networking for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
210210
}
@@ -326,6 +326,7 @@
326326
"aiFoundryAiProjectDescription": "AI Foundry Project",
327327
"aiSearchName": "[format('srch-{0}', variables('solutionSuffix'))]",
328328
"aiSearchConnectionName": "[format('foundry-search-connection-{0}', variables('solutionSuffix'))]",
329+
"nenablePrivateNetworking": false,
329330
"storageAccountName": "[format('st{0}', variables('solutionSuffix'))]",
330331
"cosmosDBResourceName": "[format('cosmos-{0}', variables('solutionSuffix'))]",
331332
"cosmosDBDatabaseName": "db_conversation_history",
@@ -363,7 +364,7 @@
363364
"apiVersion": "2021-04-01",
364365
"name": "default",
365366
"properties": {
366-
"tags": "[shallowMerge(createArray(parameters('tags'), createObject('TemplateName', 'Docgen')))]"
367+
"tags": "[shallowMerge(createArray(parameters('tags'), createObject('TemplateName', 'Docgen', 'SecurityControl', 'Ignore')))]"
367368
}
368369
},
369370
"existingAiFoundryAiServices": {
@@ -419,6 +420,7 @@
419420
]
420421
},
421422
"webSiteLogs": {
423+
"condition": "[parameters('enableMonitoring')]",
422424
"type": "Microsoft.Web/sites/config",
423425
"apiVersion": "2024-04-01",
424426
"name": "[format('{0}/logs', variables('webSiteResourceName'))]",
@@ -4806,7 +4808,7 @@
48064808
"_generator": {
48074809
"name": "bicep",
48084810
"version": "0.37.4.10188",
4809-
"templateHash": "3782899527809411245"
4811+
"templateHash": "11140120105546145557"
48104812
}
48114813
},
48124814
"parameters": {
@@ -4866,7 +4868,7 @@
48664868
{
48674869
"type": "Microsoft.Resources/deployments",
48684870
"apiVersion": "2022-09-01",
4869-
"name": "[take(format('module.network-main.{0}', parameters('resourcesName')), 64)]",
4871+
"name": "[take(format('network-{0}-create', parameters('resourcesName')), 64)]",
48704872
"properties": {
48714873
"expressionEvaluationOptions": {
48724874
"scope": "inner"
@@ -20460,42 +20462,42 @@
2046020462
"metadata": {
2046120463
"description": "Name of the Virtual Network resource."
2046220464
},
20463-
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.network-main.{0}', parameters('resourcesName')), 64)), '2022-09-01').outputs.vnetName.value]"
20465+
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('network-{0}-create', parameters('resourcesName')), 64)), '2022-09-01').outputs.vnetName.value]"
2046420466
},
2046520467
"vnetResourceId": {
2046620468
"type": "string",
2046720469
"metadata": {
2046820470
"description": "Resource ID of the Virtual Network."
2046920471
},
20470-
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.network-main.{0}', parameters('resourcesName')), 64)), '2022-09-01').outputs.vnetResourceId.value]"
20472+
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('network-{0}-create', parameters('resourcesName')), 64)), '2022-09-01').outputs.vnetResourceId.value]"
2047120473
},
2047220474
"subnetWebResourceId": {
2047320475
"type": "string",
2047420476
"metadata": {
2047520477
"description": "Resource ID of the \"web\" subnet."
2047620478
},
20477-
"value": "[coalesce(tryGet(first(filter(reference(resourceId('Microsoft.Resources/deployments', take(format('module.network-main.{0}', parameters('resourcesName')), 64)), '2022-09-01').outputs.subnets.value, lambda('s', equals(lambdaVariables('s').name, 'web')))), 'resourceId'), '')]"
20479+
"value": "[coalesce(tryGet(first(filter(reference(resourceId('Microsoft.Resources/deployments', take(format('network-{0}-create', parameters('resourcesName')), 64)), '2022-09-01').outputs.subnets.value, lambda('s', equals(lambdaVariables('s').name, 'web')))), 'resourceId'), '')]"
2047820480
},
2047920481
"subnetPrivateEndpointsResourceId": {
2048020482
"type": "string",
2048120483
"metadata": {
2048220484
"description": "Resource ID of the \"peps\" subnet for Private Endpoints."
2048320485
},
20484-
"value": "[coalesce(tryGet(first(filter(reference(resourceId('Microsoft.Resources/deployments', take(format('module.network-main.{0}', parameters('resourcesName')), 64)), '2022-09-01').outputs.subnets.value, lambda('s', equals(lambdaVariables('s').name, 'peps')))), 'resourceId'), '')]"
20486+
"value": "[coalesce(tryGet(first(filter(reference(resourceId('Microsoft.Resources/deployments', take(format('network-{0}-create', parameters('resourcesName')), 64)), '2022-09-01').outputs.subnets.value, lambda('s', equals(lambdaVariables('s').name, 'peps')))), 'resourceId'), '')]"
2048520487
},
2048620488
"bastionResourceId": {
2048720489
"type": "string",
2048820490
"metadata": {
2048920491
"description": "Resource ID of the Bastion Host."
2049020492
},
20491-
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.network-main.{0}', parameters('resourcesName')), 64)), '2022-09-01').outputs.bastionHostId.value]"
20493+
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('network-{0}-create', parameters('resourcesName')), 64)), '2022-09-01').outputs.bastionHostId.value]"
2049220494
},
2049320495
"jumpboxResourceId": {
2049420496
"type": "string",
2049520497
"metadata": {
2049620498
"description": "Resource ID of the Jumpbox VM."
2049720499
},
20498-
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.network-main.{0}', parameters('resourcesName')), 64)), '2022-09-01').outputs.jumpboxResourceId.value]"
20500+
"value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('network-{0}-create', parameters('resourcesName')), 64)), '2022-09-01').outputs.jumpboxResourceId.value]"
2049920501
}
2050020502
}
2050120503
}
@@ -29861,9 +29863,9 @@
2986129863
}
2986229864
},
2986329865
"dependsOn": [
29866+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
2986429867
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
2986529868
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
29866-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
2986729869
"logAnalyticsWorkspace",
2986829870
"network",
2986929871
"userAssignedIdentity"
@@ -30121,9 +30123,7 @@
3012130123
"hostingMode": {
3012230124
"value": "default"
3012330125
},
30124-
"sku": {
30125-
"value": "standard"
30126-
},
30126+
"sku": "[if(parameters('enableScalability'), createObject('value', 'standard'), createObject('value', 'basic'))]",
3012730127
"managedIdentities": {
3012830128
"value": {
3012930129
"systemAssigned": true
@@ -30168,8 +30168,8 @@
3016830168
"semanticSearch": {
3016930169
"value": "free"
3017030170
},
30171-
"publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
30172-
"privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('aiSearchName')), 'customNetworkInterfaceName', format('nic-{0}', variables('aiSearchName')), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').searchService)).outputs.resourceId.value))), 'service', 'searchService', 'subnetResourceId', reference('network').outputs.subnetPrivateEndpointsResourceId.value))), createObject('value', createArray()))]"
30171+
"publicNetworkAccess": "[if(variables('nenablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
30172+
"privateEndpoints": "[if(variables('nenablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('aiSearchName')), 'customNetworkInterfaceName', format('nic-{0}', variables('aiSearchName')), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').searchService)).outputs.resourceId.value))), 'subnetResourceId', reference('network').outputs.subnetPrivateEndpointsResourceId.value, 'service', 'searchService'))), createObject('value', createArray()))]"
3017330173
},
3017430174
"template": {
3017530175
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -38338,8 +38338,8 @@
3833838338
}
3833938339
},
3834038340
"dependsOn": [
38341-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
3834238341
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageQueue)]",
38342+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
3834338343
"network",
3834438344
"userAssignedIdentity"
3834538345
]

‎infra/main.waf.parameters.json‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
"solutionName": {
66
"value": "${AZURE_ENV_NAME}"
77
},
8-
"location": {
8+
"AZURE_LOCATION": {
99
"value": "${AZURE_LOCATION}"
1010
},
1111
"secondaryLocation": {
1212
"value": "${AZURE_ENV_SECONDARY_LOCATION}"
1313
},
14-
"azureAiServiceLocation": {
14+
"aiDeploymentsLocation": {
1515
"value": "${AZURE_ENV_OPENAI_LOCATION}"
1616
},
1717
"gptModelDeploymentType": {
@@ -26,17 +26,17 @@
2626
"gptModelCapacity": {
2727
"value": "${AZURE_ENV_MODEL_CAPACITY}"
2828
},
29-
"enableTelemetry": {
30-
"value": "${AZURE_ENV_ENABLE_TELEMETRY}"
29+
"embeddingModel": {
30+
"value": "${AZURE_ENV_EMBEDDING_MODEL}"
3131
},
32-
"enableMonitoring": {
33-
"value": true
32+
"embeddingDeploymentCapacity": {
33+
"value": "${AZURE_ENV_EMBEDDING_DEPLOYMENT_CAPACITY}"
3434
},
35-
"enablePrivateNetworking": {
36-
"value": true
35+
"existingLogAnalyticsWorkspaceId": {
36+
"value": "${AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_ID}"
3737
},
38-
"enableScalability": {
39-
"value": true
38+
"azureExistingAIProjectResourceId": {
39+
"value": "${AZURE_ENV_EXISTING_AI_PROJECT_RESOURCE_ID}"
4040
},
4141
"vmSize": {
4242
"value": "${AZURE_ENV_JUMPBOX_SIZE}"
@@ -46,6 +46,24 @@
4646
},
4747
"vmAdminPassword": {
4848
"value": "${AZURE_ENV_JUMPBOX_ADMIN_PASSWORD}"
49+
},
50+
"enableMonitoring": {
51+
"value": true
52+
},
53+
"enableScalability": {
54+
"value": true
55+
},
56+
"enableRedundancy": {
57+
"value": true
58+
},
59+
"enablePrivateNetworking": {
60+
"value": true
61+
},
62+
"enableTelemetry": {
63+
"value": "${AZURE_ENV_ENABLE_TELEMETRY}"
64+
},
65+
"enablePurgeProtection": {
66+
"value": "${AZURE_ENV_ENABLE_PURGE_PROTECTION}"
4967
}
5068
}
5169
}

0 commit comments

Comments
 (0)