Skip to content

Commit e17125b

Browse files
Prajwal-MicrosoftVishalS-MicrosoftNirajC-MicrosoftHarsh-MicrosoftVamshi-Microsoft
authored
refactor: removed commented code, fixes for Standard Gallery validation & updated docs (microsoft#692)
* fix: added tags in CAdeploy.yml file (microsoft#675) * CI Pipeline fix for Client Advisor * added tags in CAdeploy.yml file * add my feature branch * tags changes updated in CAdeploy.yml file * added template name condition based * removed my feature branch from pipeline * Additional Troubleshooting steps * fix: Remove createdby from pipeline and add change Createdby logic in bice… (microsoft#678) * Remove createdby from pipeline and add change Createdby logic in bicep file * Add 'createdBy' parameter to Azure deployment * Add 'createdBy' parameter for tagging * added new 'type' tag (microsoft#682) * Create new Managed Identity for SQL operations with least privileges * Update docs/TroubleShootingSteps.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update GitHub Issues link in troubleshooting steps * removed SQL user assigned identity from key vault and SQL DB module * Refactor DNS zone naming and update SQL database redundancy settings * fix pylint issues * refactor: Update README, azure.yml for minimum azd version 1.18.0 & removed the unsued params (microsoft#690) * fix: Dev to main (microsoft#681) * fix: added tags in CAdeploy.yml file (microsoft#675) * CI Pipeline fix for Client Advisor * added tags in CAdeploy.yml file * add my feature branch * tags changes updated in CAdeploy.yml file * added template name condition based * removed my feature branch from pipeline * Additional Troubleshooting steps * fix: Remove createdby from pipeline and add change Createdby logic in bice… (microsoft#678) * Remove createdby from pipeline and add change Createdby logic in bicep file * Add 'createdBy' parameter to Azure deployment * Add 'createdBy' parameter for tagging * added new 'type' tag (microsoft#682) * Update docs/TroubleShootingSteps.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update GitHub Issues link in troubleshooting steps --------- Co-authored-by: VishalS-Microsoft <v-vishshinde@microsoft.com> Co-authored-by: Harsh-Microsoft <v-hbangera@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: Removed commented params * Update README and azure.yml for minimum azd version 1.18.0 --------- Co-authored-by: NirajC-Microsoft <v-nirajcha@microsoft.com> Co-authored-by: VishalS-Microsoft <v-vishshinde@microsoft.com> Co-authored-by: Harsh-Microsoft <v-hbangera@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Prajwal D C <v-dcprajwal@microsoft.com> * Update Azure template validation action to latest version * Update azure-dev.yml * Update azure-dev.yml * Chore: Disable Dev Container usage in Azure validation step Disable the use of Dev Container for Azure template validation. * chore: Refactor Azure DevOps workflow configuration * fix: Rename main.bicep for network module * chore: Update Azure template validation action version * chore: Add validateTests parameter to Azure Dev workflow * chore: Update Azure template validation action version * fix post deployment script to support exp * refactor: Comments fixed --------- Co-authored-by: VishalS-Microsoft <v-vishshinde@microsoft.com> Co-authored-by: NirajC-Microsoft <v-nirajcha@microsoft.com> Co-authored-by: Harsh-Microsoft <v-hbangera@microsoft.com> Co-authored-by: Vamshi-Microsoft <v-vamolla@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Roopan-Microsoft <168007406+Roopan-Microsoft@users.noreply.github.com>
1 parent 7a86f2c commit e17125b

File tree

11 files changed

+619
-95
lines changed

11 files changed

+619
-95
lines changed

‎.github/workflows/azure-dev.yml‎

Lines changed: 36 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,37 @@
1-
name: Azure Template Validation
2-
on:
3-
push:
4-
branches:
5-
- main
6-
- dev
7-
workflow_dispatch:
8-
9-
permissions:
10-
contents: read
11-
id-token: write
12-
pull-requests: write
13-
14-
jobs:
15-
template_validation_job:
1+
name: Azure Template Validation
2+
on:
3+
workflow_dispatch:
4+
push:
5+
branches:
6+
- main
7+
permissions:
8+
contents: read
9+
id-token: write
10+
pull-requests: write
11+
jobs:
12+
template_validation_job:
13+
runs-on: ubuntu-latest
1614
environment: production
17-
runs-on: ubuntu-latest
18-
name: Template validation
19-
20-
steps:
21-
# Step 1: Checkout the code from your repository
22-
- name: Checkout code
23-
uses: actions/checkout@v4
24-
25-
# Step 2: Validate the Azure template using microsoft/template-validation-action
26-
- name: Validate Azure Template
27-
uses: microsoft/template-validation-action@v0.3.5
28-
id: validation
29-
env:
30-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
31-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
32-
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
33-
AZURE_ENV_NAME: ${{ secrets.AZURE_ENV_NAME }}
34-
AZURE_LOCATION: ${{ secrets.AZURE_LOCATION }}
35-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
36-
37-
# Step 3: Print the result of the validation
38-
- name: Print result
39-
run: cat ${{ steps.validation.outputs.resultFile }}
15+
name: Template validation
16+
steps:
17+
# Step 1: Checkout the code from your repository
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
# Step 2: Validate the Azure template using microsoft/template-validation-action
21+
- name: Validate Azure Template
22+
uses: microsoft/template-validation-action@v0.4.2
23+
id: validation
24+
with:
25+
useDevContainer: false
26+
validateTests: ''
27+
env:
28+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
29+
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
30+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
31+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
32+
AZURE_ENV_NAME: ${{ secrets.AZURE_ENV_NAME }}
33+
AZURE_LOCATION: ${{ secrets.AZURE_LOCATION }}
34+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
# Step 3: Print the result of the validation
36+
- name: Print result
37+
run: cat ${{ steps.validation.outputs.resultFile }}

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,8 @@ Quick deploy
6363
### How to install or deploy
6464
Follow the quick deploy steps on the deployment guide to deploy this solution to your own Azure subscription.
6565

66+
> **Note:** This solution accelerator requires **Azure Developer CLI (azd) version 1.18.0 or higher**. Please ensure you have the latest version installed before proceeding with deployment. [Download azd here](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/install-azd).
67+
6668
[Click here to launch the deployment guide](./docs/DeploymentGuide.md)
6769
<br/><br/>
6870

‎azure.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
name: build-your-own-copilot-solution-accelerator
44

55
requiredVersions:
6-
azd: ">= 1.15.0"
6+
azd: ">= 1.18.0"
77

88
metadata:
99
template: build-your-own-copilot-solution-accelerator@1.0

‎docs/DeploymentGuide.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ If you're not using one of the above options for opening the project, then you'l
111111

112112
1. Make sure the following tools are installed:
113113
- [PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell?view=powershell-7.5) <small>(v7.0+)</small> - available for Windows, macOS, and Linux.
114-
- [Azure Developer CLI (azd)](https://aka.ms/install-azd) <small>(v1.15.0+)</small> - version
114+
- [Azure Developer CLI (azd)](https://aka.ms/install-azd) <small>(v1.18.0+)</small> - version
115115
- [Python 3.9 to 3.11](https://www.python.org/downloads/)
116116
- [Docker Desktop](https://www.docker.com/products/docker-desktop/)
117117
- [Git](https://git-scm.com/downloads)
@@ -213,6 +213,7 @@ Once you've opened the project in [Codespaces](#github-codespaces), [Dev Contain
213213
```shell
214214
azd up
215215
```
216+
> **Note:** This solution accelerator requires **Azure Developer CLI (azd) version 1.18.0 or higher**. Please ensure you have the latest version installed before proceeding with deployment. [Download azd here](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/install-azd).
216217
217218
3. Provide an `azd` environment name (e.g., "byocaapp").
218219
4. Select a subscription from your Azure account and choose a location that has quota for all the resources.

‎infra/main.bicep‎

Lines changed: 35 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,6 @@ param embeddingModel string = 'text-embedding-ada-002'
5353
@description('Optional. Capacity of the Embedding Model deployment')
5454
param embeddingDeploymentCapacity int = 80
5555

56-
// @description('Fabric Workspace Id if you have one, else leave it empty. ')
57-
// param fabricWorkspaceId string
58-
5956
//restricting to these regions because assistants api for gpt-4o-mini is available only in these regions
6057
@allowed([
6158
'australiaeast'
@@ -68,8 +65,6 @@ param embeddingDeploymentCapacity int = 80
6865
'westus'
6966
'westus3'
7067
])
71-
// @description('Azure OpenAI Location')
72-
// param AzureOpenAILocation string = 'eastus2'
7368
@metadata({
7469
azd: {
7570
type: 'location'
@@ -174,12 +169,10 @@ param vmSize string?
174169

175170
@description('Optional. Admin username for the Jumpbox Virtual Machine. Set to custom value if enablePrivateNetworking is true.')
176171
@secure()
177-
//param vmAdminUsername string = take(newGuid(), 20)
178172
param vmAdminUsername string?
179173

180174
@description('Optional. Admin password for the Jumpbox Virtual Machine. Set to custom value if enablePrivateNetworking is true.')
181175
@secure()
182-
//param vmAdminPassword string = newGuid()
183176
param vmAdminPassword string?
184177

185178
var functionAppSqlPrompt = '''Generate a valid T-SQL query to find {query} for tables and columns provided below:
@@ -264,14 +257,6 @@ var cosmosDbHaLocation = cosmosDbZoneRedundantHaRegionPairs[resourceGroup().loca
264257

265258
// Extracts subscription, resource group, and workspace name from the resource ID when using an existing Log Analytics workspace
266259
var useExistingLogAnalytics = !empty(existingLogAnalyticsWorkspaceId)
267-
var existingLawSubscription = useExistingLogAnalytics ? split(existingLogAnalyticsWorkspaceId, '/')[2] : ''
268-
var existingLawResourceGroup = useExistingLogAnalytics ? split(existingLogAnalyticsWorkspaceId, '/')[4] : ''
269-
var existingLawName = useExistingLogAnalytics ? split(existingLogAnalyticsWorkspaceId, '/')[8] : ''
270-
271-
resource existingLogAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2020-08-01' existing = if (useExistingLogAnalytics) {
272-
name: existingLawName
273-
scope: resourceGroup(existingLawSubscription, existingLawResourceGroup)
274-
}
275260

276261
var logAnalyticsWorkspaceResourceId = useExistingLogAnalytics ? existingLogAnalyticsWorkspaceId : logAnalyticsWorkspace!.outputs.resourceId
277262

@@ -388,6 +373,19 @@ module userAssignedIdentity 'br/public:avm/res/managed-identity/user-assigned-id
388373
}
389374
}
390375

376+
// ========== SQL Operations User Assigned Identity ========== //
377+
// Dedicated identity for backend SQL operations with limited permissions (db_datareader, db_datawriter)
378+
var sqlUserAssignedIdentityResourceName = 'id-sql-${solutionSuffix}'
379+
module sqlUserAssignedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.1' = {
380+
name: take('avm.res.managed-identity.user-assigned-identity.${sqlUserAssignedIdentityResourceName}', 64)
381+
params: {
382+
name: sqlUserAssignedIdentityResourceName
383+
location: solutionLocation
384+
tags: tags
385+
enableTelemetry: enableTelemetry
386+
}
387+
}
388+
391389
// ========== Network Module ========== //
392390
module network 'modules/network.bicep' = if (enablePrivateNetworking) {
393391
name: take('network-${solutionSuffix}-deployment', 64)
@@ -450,7 +448,7 @@ var aiRelatedDnsZoneIndices = [
450448
@batchSize(5)
451449
module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
452450
for (zone, i) in privateDnsZones: if (enablePrivateNetworking && (empty(existingFoundryProjectResourceId) || !contains(aiRelatedDnsZoneIndices, i))) {
453-
name: 'dns-zone-${i}'
451+
name: 'avm.res.network.private-dns-zone.${split(zone, '.')[1]}'
454452
params: {
455453
name: zone
456454
tags: tags
@@ -509,6 +507,11 @@ module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
509507
principalType: 'ServicePrincipal'
510508
roleDefinitionIdOrName: 'Key Vault Administrator'
511509
}
510+
{
511+
principalId: sqlUserAssignedIdentity.outputs.principalId
512+
principalType: 'ServicePrincipal'
513+
roleDefinitionIdOrName: 'Key Vault Secrets User'
514+
}
512515
]
513516
secrets: [
514517
{
@@ -896,7 +899,11 @@ module sqlDBModule 'br/public:avm/res/sql/server:0.20.1' = {
896899
connectionPolicy: 'Redirect'
897900
databases: [
898901
{
899-
availabilityZone: enableRedundancy ? 1 : -1
902+
zoneRedundant: enableRedundancy
903+
// When enableRedundancy is true (zoneRedundant=true), set availabilityZone to -1
904+
// to let Azure automatically manage zone placement across multiple zones.
905+
// When enableRedundancy is false, also use -1 (no specific zone assignment).
906+
availabilityZone: -1
900907
collation: 'SQL_Latin1_General_CP1_CI_AS'
901908
diagnosticSettings: enableMonitoring
902909
? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }]
@@ -988,7 +995,7 @@ module webSite 'modules/web-sites.bicep' = {
988995
name: webSiteResourceName
989996
tags: tags
990997
location: solutionLocation
991-
managedIdentities: { userAssignedResourceIds: [userAssignedIdentity!.outputs.resourceId] }
998+
managedIdentities: { userAssignedResourceIds: [userAssignedIdentity!.outputs.resourceId, sqlUserAssignedIdentity!.outputs.resourceId] }
992999
kind: 'app,linux,container'
9931000
serverFarmResourceId: webServerFarm.?outputs.resourceId
9941001
siteConfig: {
@@ -1035,7 +1042,7 @@ module webSite 'modules/web-sites.bicep' = {
10351042
AZURE_COSMOSDB_CONVERSATIONS_CONTAINER: collectionName
10361043
AZURE_COSMOSDB_DATABASE: cosmosDbDatabaseName
10371044
AZURE_COSMOSDB_ENABLE_FEEDBACK: azureCosmosDbEnableFeedback
1038-
SQLDB_USER_MID: userAssignedIdentity.outputs.clientId
1045+
SQLDB_USER_MID: sqlUserAssignedIdentity.outputs.clientId
10391046
AZURE_AI_SEARCH_ENDPOINT: 'https://${aiSearchName}.search.windows.net'
10401047
AZURE_SQL_SYSTEM_PROMPT: functionAppSqlPrompt
10411048
AZURE_CALL_TRANSCRIPT_SYSTEM_PROMPT: functionAppCallTranscriptSystemPrompt
@@ -1226,6 +1233,12 @@ output MANAGEDIDENTITY_WEBAPP_NAME string = userAssignedIdentity.outputs.name
12261233

12271234
@description('Client ID of the managed identity used by the web app.')
12281235
output MANAGEDIDENTITY_WEBAPP_CLIENTID string = userAssignedIdentity.outputs.clientId
1236+
1237+
@description('Name of the managed identity used for SQL database operations.')
1238+
output MANAGEDIDENTITY_SQL_NAME string = sqlUserAssignedIdentity.outputs.name
1239+
1240+
@description('Client ID of the managed identity used for SQL database operations.')
1241+
output MANAGEDIDENTITY_SQL_CLIENTID string = sqlUserAssignedIdentity.outputs.clientId
12291242
@description('Name of the AI Search service.')
12301243
output AI_SEARCH_SERVICE_NAME string = aiSearchName
12311244

@@ -1367,3 +1380,6 @@ output USE_AI_PROJECT_CLIENT string = useAIProjectClientFlag
13671380

13681381
@description('Indicates whether the internal stream should be used.')
13691382
output USE_INTERNAL_STREAM string = useInternalStream
1383+
1384+
@description('The client ID of the managed identity.')
1385+
output AZURE_CLIENT_ID string = userAssignedIdentity.outputs.clientId

0 commit comments

Comments
 (0)