|
| 1 | +// --------------------------------------------------------------------------- |
| 2 | +// MCP Server App Service |
| 3 | +// |
| 4 | +// Hosts the Model Context Protocol server that exposes Application Insights |
| 5 | +// analytics tools to AI agents (e.g. Claude Desktop). |
| 6 | +// |
| 7 | +// Auth model |
| 8 | +// Outbound — SystemAssigned Managed Identity → Azure Monitor / Log Analytics |
| 9 | +// Inbound — Enable Easy Auth (Azure AD) via the portal or a separate Bicep |
| 10 | +// module once you have an Entra ID app registration. |
| 11 | +// --------------------------------------------------------------------------- |
| 12 | + |
| 13 | +param location string |
| 14 | +param environment string |
| 15 | +param appServicePlanName string |
| 16 | +param mcpAppName string |
| 17 | + |
| 18 | +@description('Log Analytics workspace ARM resource ID (for the role assignment scope).') |
| 19 | +param logAnalyticsWorkspaceId string |
| 20 | + |
| 21 | +@description('Log Analytics workspace GUID (customerId) — passed to the app as AppInsights__WorkspaceId.') |
| 22 | +param logAnalyticsWorkspaceCustomerId string |
| 23 | + |
| 24 | +param appInsightsConnectionString string |
| 25 | +param keyVaultUri string |
| 26 | + |
| 27 | +var tags = { |
| 28 | + environment: environment |
| 29 | + project: 'XenobiaSoftSudoku' |
| 30 | + component: 'mcp' |
| 31 | +} |
| 32 | + |
| 33 | +// --------------------------------------------------------------------------- |
| 34 | +// Reference the shared App Service Plan (read-only) |
| 35 | +// --------------------------------------------------------------------------- |
| 36 | + |
| 37 | +resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' existing = { |
| 38 | + name: appServicePlanName |
| 39 | +} |
| 40 | + |
| 41 | +// --------------------------------------------------------------------------- |
| 42 | +// MCP App Service |
| 43 | +// --------------------------------------------------------------------------- |
| 44 | + |
| 45 | +resource mcpApp 'Microsoft.Web/sites@2023-12-01' = { |
| 46 | + name: mcpAppName |
| 47 | + location: location |
| 48 | + kind: 'app,linux' |
| 49 | + tags: tags |
| 50 | + identity: { |
| 51 | + type: 'SystemAssigned' |
| 52 | + } |
| 53 | + properties: { |
| 54 | + serverFarmId: appServicePlan.id |
| 55 | + httpsOnly: true |
| 56 | + clientAffinityEnabled: false |
| 57 | + reserved: true |
| 58 | + keyVaultReferenceIdentity: 'SystemAssigned' |
| 59 | + siteConfig: { |
| 60 | + linuxFxVersion: 'DOTNETCORE|10.0' |
| 61 | + alwaysOn: true |
| 62 | + http20Enabled: true |
| 63 | + numberOfWorkers: 1 |
| 64 | + } |
| 65 | + } |
| 66 | +} |
| 67 | + |
| 68 | +resource mcpAppConfig 'Microsoft.Web/sites/config@2023-12-01' = { |
| 69 | + parent: mcpApp |
| 70 | + name: 'web' |
| 71 | + properties: { |
| 72 | + linuxFxVersion: 'DOTNETCORE|10.0' |
| 73 | + alwaysOn: true |
| 74 | + http20Enabled: true |
| 75 | + minTlsVersion: '1.2' |
| 76 | + scmMinTlsVersion: '1.2' |
| 77 | + ftpsState: 'FtpsOnly' |
| 78 | + healthCheckPath: '/health-check' |
| 79 | + managedPipelineMode: 'Integrated' |
| 80 | + loadBalancing: 'LeastRequests' |
| 81 | + virtualApplications: [ |
| 82 | + { |
| 83 | + virtualPath: '/' |
| 84 | + physicalPath: 'site\\wwwroot' |
| 85 | + preloadEnabled: true |
| 86 | + } |
| 87 | + ] |
| 88 | + remoteDebuggingEnabled: false |
| 89 | + webSocketsEnabled: true // required for SSE keep-alive |
| 90 | + use32BitWorkerProcess: true |
| 91 | + } |
| 92 | +} |
| 93 | + |
| 94 | +resource mcpAppSettings 'Microsoft.Web/sites/config@2023-12-01' = { |
| 95 | + parent: mcpApp |
| 96 | + name: 'appsettings' |
| 97 | + properties: { |
| 98 | + APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString |
| 99 | + ApplicationInsightsAgent_EXTENSION_VERSION: '~3' |
| 100 | + ConnectionStrings__AzureKeyVault: keyVaultUri |
| 101 | + // Workspace GUID consumed by LogsQueryClient in ApplicationInsightsTools |
| 102 | + AppInsights__WorkspaceId: logAnalyticsWorkspaceCustomerId |
| 103 | + } |
| 104 | +} |
| 105 | + |
| 106 | +// --------------------------------------------------------------------------- |
| 107 | +// RBAC — grant Managed Identity read access to Log Analytics |
| 108 | +// |
| 109 | +// Log Analytics Reader (73c42c96-874c-492b-b04d-ab87d138a893) |
| 110 | +// Allows QueryWorkspace calls against the workspace. |
| 111 | +// |
| 112 | +// Monitoring Reader (43d0d8ad-25c7-4714-9337-8ba259a9fe05) |
| 113 | +// Allows reading metrics from the Application Insights resource. |
| 114 | +// --------------------------------------------------------------------------- |
| 115 | + |
| 116 | +var logAnalyticsReaderRoleId = '73c42c96-874c-492b-b04d-ab87d138a893' |
| 117 | +var monitoringReaderRoleId = '43d0d8ad-25c7-4714-9337-8ba259a9fe05' |
| 118 | + |
| 119 | +resource logAnalyticsReaderAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { |
| 120 | + // Scope to the workspace so the identity can only query this workspace |
| 121 | + scope: resourceGroup() |
| 122 | + name: guid(logAnalyticsWorkspaceId, mcpApp.id, logAnalyticsReaderRoleId) |
| 123 | + properties: { |
| 124 | + roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', logAnalyticsReaderRoleId) |
| 125 | + principalId: mcpApp.identity.principalId |
| 126 | + principalType: 'ServicePrincipal' |
| 127 | + } |
| 128 | +} |
| 129 | + |
| 130 | +resource monitoringReaderAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { |
| 131 | + scope: resourceGroup() |
| 132 | + name: guid(logAnalyticsWorkspaceId, mcpApp.id, monitoringReaderRoleId) |
| 133 | + properties: { |
| 134 | + roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', monitoringReaderRoleId) |
| 135 | + principalId: mcpApp.identity.principalId |
| 136 | + principalType: 'ServicePrincipal' |
| 137 | + } |
| 138 | +} |
| 139 | + |
| 140 | +// --------------------------------------------------------------------------- |
| 141 | +// Outputs |
| 142 | +// --------------------------------------------------------------------------- |
| 143 | + |
| 144 | +output mcpAppUrl string = mcpApp.properties.defaultHostName |
| 145 | +output mcpAppId string = mcpApp.id |
| 146 | +output mcpAppPrincipalId string = mcpApp.identity.principalId |
0 commit comments