Skip to content

Commit 1a874a1

Browse files
ckittelckittel
authored
Move to DataZone and add policies
1 parent 5c510e6 commit 1a874a1

File tree

4 files changed

+280
-6
lines changed

4 files changed

+280
-6
lines changed

‎infra-as-code/bicep/ai-foundry-project.bicep‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,8 @@ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' exi
147147
type: 'SystemAssigned'
148148
}
149149
properties: {
150-
description: 'Chat using internet data'
151-
displayName: 'ChatWithInternetData'
150+
description: 'Chat using internet data in your Azure AI Agent.'
151+
displayName: 'Chat with Internet Data'
152152
}
153153

154154
@description('Create project connection to CosmosDB (thread storage); dependency for Azure AI Agent service.')

‎infra-as-code/bicep/ai-foundry.bicep‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {
9595
name: 'agent-model'
9696
sku: {
9797
capacity: 50
98-
name: 'GlobalStandard'
98+
name: 'DataZoneStandard' // Production readiness, use provisioned deployments with automatic spillover https://learn.microsoft.com/azure/ai-services/openai/how-to/spillover-traffic-management.
9999
}
100100
properties: {
101101
model: {
@@ -104,10 +104,9 @@ resource aiFoundry 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {
104104
version: '2024-11-20' // Use a model version available in your region.
105105
}
106106
versionUpgradeOption: 'NoAutoUpgrade' // Production deployments should not auto-upgrade models. Testing compatibility is important.
107+
raiPolicyName: 'Microsoft.DefaultV2' // If this isn't strict enough for your use case, create a custom RAI policy.
107108
}
108109
}
109-
110-
// TODO: Bring back the custom policy creation to showcase it.
111110
}
112111

113112
// Role assignments

‎infra-as-code/bicep/azure-policies.bicep‎

Lines changed: 268 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,268 @@
1+
targetScope = 'resourceGroup'
2+
3+
// Make sure the resource group has a few key Azure Policies applied to it. These could also be applied at the subscription
4+
// or management group level. Applying locally to the resource group is useful for testing and development purposes.
5+
6+
// This is just a sampling of the types of policy you could apply to your resource group. Please make sure your production deployment
7+
// has all policies applied that are relevant to your workload. Most of these policies can be applied in 'Deny' mode, but in case you
8+
// need to troubleshoot some of the resources, we've left them in 'Audit' mode for now.
9+
10+
@description('This is the base name for each Azure resource name (6-8 chars). It\'s used as a prefix in Azure Policy assignments')
11+
@minLength(6)
12+
@maxLength(8)
13+
param baseName string
14+
15+
// Existing built-in policy definitions
16+
@description('Policy definition for ensuring Azure AI Services resources have key access disabled to improve security posture.')
17+
resource aiServicesKeyAccessPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
18+
name: '71ef260a-8f18-47b7-abcb-62d0673d94dc'
19+
scope: tenant()
20+
}
21+
22+
@description('Policy definition for restricting network access to Azure AI Services resources to prevent unauthorized access.')
23+
resource aiServicesNetworkAccessPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
24+
name: '037eea7a-bd0a-46c5-9a66-03aea78705d3'
25+
scope: tenant()
26+
}
27+
28+
@description('Policy definition for ensuring Cosmos DB accounts are configured with zone redundancy for high availability.')
29+
resource cosmosDbZoneRedundantPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
30+
name: '44c5a1f9-7ef6-4c38-880c-273e8f7a3c24'
31+
scope: tenant()
32+
}
33+
34+
@description('Policy definition for ensuring Cosmos DB accounts use private endpoints for secure connectivity.')
35+
resource cosmosDbPrivateLinkPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
36+
name: '58440f8a-10c5-4151-bdce-dfbaad4a20b7'
37+
scope: tenant()
38+
}
39+
40+
@description('Policy definition for disabling local authentication methods on Cosmos DB accounts to improve security.')
41+
resource cosmosDbDisableLocalAuthPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
42+
name: '5450f5bd-9c72-4390-a9c4-a7aba4edfdd2'
43+
scope: tenant()
44+
}
45+
46+
@description('Policy definition for disabling public network access on Cosmos DB accounts to enhance security.')
47+
resource cosmosDbDisablePublicNetworkPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
48+
name: '797b37f7-06b8-444c-b1ad-fc62867f335a'
49+
scope: tenant()
50+
}
51+
52+
@description('Policy definition for disabling public network access on Azure AI Search services to enhance security.')
53+
resource searchDisablePublicNetworkPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
54+
name: 'ee980b6d-0eca-4501-8d54-f6290fd512c3'
55+
scope: tenant()
56+
}
57+
58+
@description('Policy definition for ensuring Azure AI Search services are configured with zone redundancy for high availability.')
59+
resource searchZoneRedundantPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
60+
name: '90bc8109-d21a-4692-88fc-51419391da3d'
61+
scope: tenant()
62+
}
63+
64+
@description('Policy definition for disabling local authentication methods on Azure AI Search services to improve security.')
65+
resource searchDisableLocalAuthPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
66+
name: '6300012e-e9a4-4649-b41f-a85f5c43be91'
67+
scope: tenant()
68+
}
69+
70+
@description('Policy definition for disabling public network access on Storage accounts to enhance security.')
71+
resource storageDisablePublicNetworkPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
72+
name: 'b2982f36-99f2-4db5-8eff-283140c09693'
73+
scope: tenant()
74+
}
75+
76+
@description('Policy definition for preventing shared key access on Storage accounts to improve security posture.')
77+
resource storageDisableSharedKeyPolicy 'Microsoft.Authorization/policyDefinitions@2025-01-01' existing = {
78+
name: '8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54'
79+
scope: tenant()
80+
}
81+
82+
// Policy assignments
83+
@description('Policy assignment to audit Azure AI Services resources and ensure key access is disabled for enhanced security.')
84+
resource aiServicesKeyAccessAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
85+
name: guid(resourceGroup().id, aiServicesKeyAccessPolicy.id)
86+
scope: resourceGroup()
87+
properties: {
88+
displayName: '${resourceGroup().name} - ${aiServicesKeyAccessPolicy.properties.displayName}'
89+
description: aiServicesKeyAccessPolicy.properties.description
90+
policyDefinitionId: aiServicesKeyAccessPolicy.id
91+
enforcementMode: 'Default'
92+
parameters: {
93+
effect: {
94+
value: 'Audit'
95+
}
96+
}
97+
}
98+
}
99+
100+
@description('Policy assignment to audit and restrict network access for Azure AI Services resources to improve security posture.')
101+
resource aiServicesNetworkAccessAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
102+
name: guid(resourceGroup().id, aiServicesNetworkAccessPolicy.id)
103+
scope: resourceGroup()
104+
properties: {
105+
displayName: '${resourceGroup().name} - ${aiServicesNetworkAccessPolicy.properties.displayName}'
106+
description: aiServicesNetworkAccessPolicy.properties.description
107+
policyDefinitionId: aiServicesNetworkAccessPolicy.id
108+
enforcementMode: 'Default'
109+
parameters: {
110+
effect: {
111+
value: 'Audit'
112+
}
113+
}
114+
}
115+
}
116+
117+
@description('Policy assignment to audit Cosmos DB accounts and ensure zone redundancy is configured for high availability.')
118+
resource cosmosDbZoneRedundantAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
119+
name: guid(resourceGroup().id, cosmosDbZoneRedundantPolicy.id)
120+
scope: resourceGroup()
121+
properties: {
122+
displayName: '${baseName} - ${cosmosDbZoneRedundantPolicy.properties.displayName}'
123+
description: cosmosDbZoneRedundantPolicy.properties.description
124+
policyDefinitionId: cosmosDbZoneRedundantPolicy.id
125+
enforcementMode: 'Default'
126+
parameters: {
127+
effect: {
128+
value: 'Audit'
129+
}
130+
}
131+
}
132+
}
133+
134+
@description('Policy assignment to audit Cosmos DB accounts and ensure they use private endpoints for secure connectivity.')
135+
resource cosmosDbPrivateLinkAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
136+
name: guid(resourceGroup().id, cosmosDbPrivateLinkPolicy.id)
137+
scope: resourceGroup()
138+
properties: {
139+
displayName: '${baseName} - ${cosmosDbPrivateLinkPolicy.properties.displayName}'
140+
description: cosmosDbPrivateLinkPolicy.properties.description
141+
policyDefinitionId: cosmosDbPrivateLinkPolicy.id
142+
enforcementMode: 'Default'
143+
parameters: {
144+
effect: {
145+
value: 'Audit'
146+
}
147+
}
148+
}
149+
}
150+
151+
@description('Policy assignment to audit Cosmos DB accounts and ensure local authentication methods are disabled for improved security.')
152+
resource cosmosDbDisableLocalAuthAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
153+
name: guid(resourceGroup().id, cosmosDbDisableLocalAuthPolicy.id)
154+
scope: resourceGroup()
155+
properties: {
156+
displayName: '${baseName} - ${cosmosDbDisableLocalAuthPolicy.properties.displayName}'
157+
description: cosmosDbDisableLocalAuthPolicy.properties.description
158+
policyDefinitionId: cosmosDbDisableLocalAuthPolicy.id
159+
enforcementMode: 'Default'
160+
parameters: {
161+
effect: {
162+
value: 'Audit'
163+
}
164+
}
165+
}
166+
}
167+
168+
@description('Policy assignment to audit Cosmos DB accounts and ensure public network access is disabled to enhance security.')
169+
resource cosmosDbDisablePublicNetworkAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
170+
name: guid(resourceGroup().id, cosmosDbDisablePublicNetworkPolicy.id)
171+
scope: resourceGroup()
172+
properties: {
173+
displayName: '${baseName} - ${cosmosDbDisablePublicNetworkPolicy.properties.displayName}'
174+
description: cosmosDbDisablePublicNetworkPolicy.properties.description
175+
policyDefinitionId: cosmosDbDisablePublicNetworkPolicy.id
176+
enforcementMode: 'Default'
177+
parameters: {
178+
effect: {
179+
value: 'Audit'
180+
}
181+
}
182+
}
183+
}
184+
185+
@description('Policy assignment to audit Azure AI Search services and ensure public network access is disabled for enhanced security.')
186+
resource searchDisablePublicNetworkAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
187+
name: guid(resourceGroup().id, searchDisablePublicNetworkPolicy.id)
188+
scope: resourceGroup()
189+
properties: {
190+
displayName: '${baseName} - ${searchDisablePublicNetworkPolicy.properties.displayName}'
191+
description: searchDisablePublicNetworkPolicy.properties.description
192+
policyDefinitionId: searchDisablePublicNetworkPolicy.id
193+
enforcementMode: 'Default'
194+
parameters: {
195+
effect: {
196+
value: 'Audit'
197+
}
198+
}
199+
}
200+
}
201+
202+
@description('Policy assignment to audit Azure AI Search services and ensure zone redundancy is configured for high availability.')
203+
resource searchZoneRedundantAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
204+
name: guid(resourceGroup().id, searchZoneRedundantPolicy.id)
205+
scope: resourceGroup()
206+
properties: {
207+
displayName: '${baseName} - ${searchZoneRedundantPolicy.properties.displayName}'
208+
description: searchZoneRedundantPolicy.properties.description
209+
policyDefinitionId: searchZoneRedundantPolicy.id
210+
enforcementMode: 'Default'
211+
parameters: {
212+
effect: {
213+
value: 'Audit'
214+
}
215+
}
216+
}
217+
}
218+
219+
@description('Policy assignment to audit Azure AI Search services and ensure local authentication methods are disabled for improved security.')
220+
resource searchDisableLocalAuthAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
221+
name: guid(resourceGroup().id, searchDisableLocalAuthPolicy.id)
222+
scope: resourceGroup()
223+
properties: {
224+
displayName: '${baseName} - ${searchDisableLocalAuthPolicy.properties.displayName}'
225+
description: searchDisableLocalAuthPolicy.properties.description
226+
policyDefinitionId: searchDisableLocalAuthPolicy.id
227+
enforcementMode: 'Default'
228+
parameters: {
229+
effect: {
230+
value: 'Audit'
231+
}
232+
}
233+
}
234+
}
235+
236+
@description('Policy assignment to audit Storage accounts and ensure public network access is disabled for enhanced security.')
237+
resource storageDisablePublicNetworkAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
238+
name: guid(resourceGroup().id, storageDisablePublicNetworkPolicy.id)
239+
scope: resourceGroup()
240+
properties: {
241+
displayName: '${baseName} - ${storageDisablePublicNetworkPolicy.properties.displayName}'
242+
description: storageDisablePublicNetworkPolicy.properties.description
243+
policyDefinitionId: storageDisablePublicNetworkPolicy.id
244+
enforcementMode: 'Default'
245+
parameters: {
246+
effect: {
247+
value: 'Audit'
248+
}
249+
}
250+
}
251+
}
252+
253+
@description('Policy assignment to audit Storage accounts and ensure shared key access is prevented for improved security posture.')
254+
resource storageDisableSharedKeyAssignment 'Microsoft.Authorization/policyAssignments@2025-01-01' = {
255+
name: guid(resourceGroup().id, storageDisableSharedKeyPolicy.id)
256+
scope: resourceGroup()
257+
properties: {
258+
displayName: '${baseName} - ${storageDisableSharedKeyPolicy.properties.displayName}'
259+
description: storageDisableSharedKeyPolicy.properties.description
260+
policyDefinitionId: storageDisableSharedKeyPolicy.id
261+
enforcementMode: 'Default'
262+
parameters: {
263+
effect: {
264+
value: 'Audit'
265+
}
266+
}
267+
}
268+
}

‎infra-as-code/bicep/main.bicep‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,11 @@ var varCuaid = 'a52aa8a8-44a8-46e9-b7a5-189ab3a64409'
4141

4242
// ---- New resources ----
4343

44-
// TODO: Add recommended Azure Policy assignments to RG prior to deploying resources.
44+
@description('Deploy an example set of Azure Policies to help you govern your workload. Expand the policy set as desired.')
45+
module applyAzurePolicies 'azure-policies.bicep' = {
46+
scope: resourceGroup()
47+
params: {}
48+
}
4549

4650
@description('This is the log sink for all Azure Diagnostics in the workload.')
4751
resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2025-02-01' = {
@@ -63,13 +67,15 @@ resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2025-02
6367

6468
@description('Deploy Virtual Network, with subnets, NSGs, and DDoS Protection.')
6569
module deployVirtualNetwork 'network.bicep' = {
70+
scope: resourceGroup()
6671
params: {
6772
location: location
6873
}
6974
}
7075

7176
@description('Control egress traffic through Azure Firewall restrictions.')
7277
module deployAzureFirewall 'azure-firewall.bicep' = {
78+
scope: resourceGroup()
7379
params: {
7480
location: location
7581
logAnalyticsWorkspaceName: logAnalyticsWorkspace.name
@@ -99,6 +105,7 @@ module deployJumpBox 'jump-box.bicep' = {
99105

100106
@description('Deploy Azure AI Foundry with Azure AI Agent capability. No projects yet deployed.')
101107
module deployAzureAIFoundry 'ai-foundry.bicep' = {
108+
scope: resourceGroup()
102109
params: {
103110
location: location
104111
baseName: baseName

0 commit comments

Comments
 (0)