Skip to content

Update Bicep and Terraform samples to create Foundry in resource group location - #1165

Open
Dennis Eikelenboom (deeikele) wants to merge 23 commits into
mainfrom
updatedsampleslocation
Open

Dennis Eikelenboom (deeikele) wants to merge 23 commits into
mainfrom
updatedsampleslocation

Conversation

@deeikele

Copy link
Copy Markdown
Contributor

No description provided.

Copilot AI balanced review requested due to automatic review settings November 13, 2026 04:47
@deeikele Dennis Eikelenboom (deeikele) changed the title Update samples to create Foundry in resource group location Update Bicep and Terraform samples to create Foundry in resource group location Nov 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Deployment-blocking regressions remain: the setup helper passes a removed location parameter, committed parameter files specify disallowed regions, and inconsistent resource locations cause provisioning failures.

35 open issues

And 15 more that still need to be addressed.

What changed in this PR

This PR updates the infrastructure samples so Foundry accounts use their resource group’s location, aligning account placement across Terraform, Bicep, and generated ARM templates.

Changes:

  • Derives Foundry locations from resource groups, adding lookups for existing groups where needed.
  • Adds region allowlists and updates Terraform defaults and example configurations.
  • Refreshes generated deployment templates, including existing networking, authentication, and monitoring changes.

Paths below are relative to infrastructure/.

File Description
infrastructure-setup-terraform/​48-bring-own-model-private-ca/​code/​variables.tf Adds region validation; defaults to Sweden Central.
infrastructure-setup-terraform/​48-bring-own-model-private-ca/​code/​terraform.tfvars.example Updates the example region.
infrastructure-setup-terraform/​48-bring-own-model-private-ca/​code/​foundry-model.tf Uses the resolved resource-group location.
infrastructure-setup-terraform/​48-bring-own-model-private-ca/​code/​foundry-agent.tf Uses the resolved resource-group location.
infrastructure-setup-terraform/​47-bring-your-own-models-platform-lob/​05-spoke-workload-project/​foundry-account.tf Looks up the spoke group’s location.
infrastructure-setup-terraform/​47-bring-your-own-models-platform-lob/​04-hub-workload/​foundry-account.tf Looks up the hub group’s location.
infrastructure-setup-terraform/​47-bring-your-own-models-platform-lob/​02-spoke-base/​variables.tf Adds region validation.
infrastructure-setup-terraform/​47-bring-your-own-models-platform-lob/​01-hub-base/​variables.tf Adds region validation.
infrastructure-setup-terraform/​46-bring-your-own-models/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​46-bring-your-own-models/​code/​platform-foundry.tf Uses the platform group’s location.
infrastructure-setup-terraform/​46-bring-your-own-models/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​46-bring-your-own-models/​code/​development-foundry.tf Uses the development group’s location.
infrastructure-setup-terraform/​45-basic-agent-bing/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​45-basic-agent-bing/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​45-basic-agent-bing/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​41-standard-agent-setup/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​41-standard-agent-setup/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​41-standard-agent-setup/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​32-customer-managed-keys-user-assigned-identity/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​32-customer-managed-keys-user-assigned-identity/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​32-customer-managed-keys-user-assigned-identity/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​31-customer-managed-keys-standard-agent/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​31-customer-managed-keys-standard-agent/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​31-customer-managed-keys-standard-agent/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​30-customer-managed-keys/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​30-customer-managed-keys/​code/​main.tf Uses the resource-group location; normalizes formatting.
infrastructure-setup-terraform/​30-customer-managed-keys/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​25-entraid-passthrough/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​25-entraid-passthrough/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​25-entraid-passthrough/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​20-user-assigned-identity/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​20-user-assigned-identity/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​20-user-assigned-identity/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​19-private-network-agent-setup-with-tools/​code/​variables.tf Adds region validation.
infrastructure-setup-terraform/​19-private-network-agent-setup-with-tools/​code/​main.tf Uses the resolved group location for Foundry and Search.
infrastructure-setup-terraform/​19-private-network-agent-setup-with-tools/​code/​locals.tf Resolves new or existing group locations.
infrastructure-setup-terraform/​19-private-network-agent-setup-with-tools/​code/​data.tf Adds an existing resource-group lookup.
infrastructure-setup-terraform/​18-managed-virtual-network/​variables.tf Adds region validation.
infrastructure-setup-terraform/​18-managed-virtual-network/​terraform.tfvars.example Aligns the example with the UAE North default.
infrastructure-setup-terraform/​17-private-network-standard-user-assigned-identity-agent-setup/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​17-private-network-standard-user-assigned-identity-agent-setup/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​17-private-network-standard-user-assigned-identity-agent-setup/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​16-private-network-standard-agent-apim-setup-preview/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​16-private-network-standard-agent-apim-setup-preview/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​16-private-network-standard-agent-apim-setup-preview/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​15b-private-network-standard-agent-setup-byovnet/​code/​variables.tf Adds region validation.
infrastructure-setup-terraform/​15b-private-network-standard-agent-setup-byovnet/​code/​main.tf Looks up the group location for Foundry and Search.
infrastructure-setup-terraform/​15a-private-network-standard-agent-setup/​code/​variables.tf Adds region validation.
infrastructure-setup-terraform/​15a-private-network-standard-agent-setup/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​11-private-network-basic-vnet/​code/​variables.tf Adds region validation.
infrastructure-setup-terraform/​11-private-network-basic-vnet/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​10-private-network-basic/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​10-private-network-basic/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​10-private-network-basic/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​04-disable-local-auth/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​04-disable-local-auth/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​04-disable-local-auth/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​03-custom-dns/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​03-custom-dns/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​03-custom-dns/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​02-storage-speech-language/​code/​variables.tf Adds region validation; defaults to East US.
infrastructure-setup-terraform/​02-storage-speech-language/​code/​main.tf Uses the resource-group location for Foundry.
infrastructure-setup-terraform/​02-storage-speech-language/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​00-basic/​code/​variables.tf Adds region validation.
infrastructure-setup-terraform/​00-basic/​code/​main.tf Uses the AzAPI resource group’s location.
infrastructure-setup-terraform/​00-basic/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-terraform/​00-basic-azurerm/​code/​variables.tf Adds region validation.
infrastructure-setup-terraform/​00-basic-azurerm/​code/​main.tf Uses the AzureRM resource group’s location.
infrastructure-setup-terraform/​00-basic-azurerm/​code/​example.tfvars Updates the example to East US.
infrastructure-setup-bicep/​48-bring-own-model-private-ca/​main.json Refreshes account locations and region restrictions.
infrastructure-setup-bicep/​48-bring-own-model-private-ca/​main.bicep Places both accounts in the group’s region; adds an allowlist.
infrastructure-setup-bicep/​48-bring-own-model-private-ca/​azuredeploy.json Refreshes the portal template’s location settings.
infrastructure-setup-bicep/​45-basic-agent-bing/​main.bicep Passes the group location to Foundry; adds region restrictions.
infrastructure-setup-bicep/​45-basic-agent-bing/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​43-standard-agent-setup-with-customization/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​43-standard-agent-setup-with-customization/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​42-basic-agent-setup-with-customization/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​42-basic-agent-setup-with-customization/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​41-standard-agent-setup/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​41-standard-agent-setup/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​40-basic-agent-setup/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​40-basic-agent-setup/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​32-customer-managed-keys-user-assigned-identity/​main.bicep Passes the group location to the account module.
infrastructure-setup-bicep/​31-customer-managed-keys-standard-agent/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​31-customer-managed-keys-standard-agent/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​30-customer-managed-keys/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​30-customer-managed-keys/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​25-entraid-passthrough/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​20-user-assigned-identity/​main.json Refreshes generated location settings.
infrastructure-setup-bicep/​20-user-assigned-identity/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​20-user-assigned-identity/​azuredeploy.json Refreshes the portal template’s location settings.
infrastructure-setup-bicep/​19-private-network-agent-tools/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​19-private-network-agent-tools/​azuredeploy.json Refreshes location settings and dependency ordering.
infrastructure-setup-bicep/​18-managed-virtual-network/​main.bicep Passes the group location to Foundry; adds region restrictions.
infrastructure-setup-bicep/​18-managed-virtual-network/​azuredeploy.json Refreshes location settings and dependency ordering.
infrastructure-setup-bicep/​17-private-network-standard-user-assigned-identity-agent-setup/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​17-private-network-standard-user-assigned-identity-agent-setup/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​16-private-network-standard-agent-apim-setup/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​16-private-network-standard-agent-apim-setup/​extensions/​ai-gateway-tier-private/​main.json Refreshes account placement and endpoint-region wiring.
infrastructure-setup-bicep/​16-private-network-standard-agent-apim-setup/​extensions/​ai-gateway-tier-private/​main.bicep Uses group locations for accounts; restricts gateway resources to Sweden Central.
infrastructure-setup-bicep/​16-private-network-standard-agent-apim-setup/​extensions/​ai-gateway-tier-private/​azuredeploy.json Refreshes account placement and gateway region restrictions.
infrastructure-setup-bicep/​16-private-network-standard-agent-apim-setup/​azuredeploy.json Refreshes locations, caller-IP access, and endpoint parameters.
infrastructure-setup-bicep/​15a-private-network-evaluation-only-setup/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​15a-private-network-evaluation-only-setup/​foundry-private-setup/​assets/​bicep/​account.bicep Removes the location input; uses the group’s region.
infrastructure-setup-bicep/​15a-private-network-evaluation-only-setup/​azuredeploy.json Refreshes account and private-endpoint location wiring.
infrastructure-setup-bicep/​15-private-network-standard-agent-setup/​main.bicep Updates allowed regions and account placement.
infrastructure-setup-bicep/​15-private-network-standard-agent-setup/​azuredeploy.json Refreshes locations, authentication controls, and DNS input handling.
infrastructure-setup-bicep/​11-private-network-basic-vnet/​modules-network-secured/​ai-account-identity.bicep Replaces the location input with the group’s region.
infrastructure-setup-bicep/​11-private-network-basic-vnet/​main.json Refreshes locations and includes private tracing resources.
infrastructure-setup-bicep/​11-private-network-basic-vnet/​main.bicep Updates region restrictions and removes the account location argument.
infrastructure-setup-bicep/​11-private-network-basic-vnet/​azuredeploy.json Refreshes locations and includes private tracing resources.
infrastructure-setup-bicep/​10-private-network-basic/​main.json Refreshes locations, naming, networking, and project configuration.
infrastructure-setup-bicep/​10-private-network-basic/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​10-private-network-basic/​azuredeploy.json Refreshes the portal template’s location settings.
infrastructure-setup-bicep/​04-disable-local-auth/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​04-disable-local-auth/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​03-custom-dns/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​03-custom-dns/​azuredeploy.json Refreshes generated location settings.
infrastructure-setup-bicep/​02-storage-speech-language/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​01-connections/​connection-foundry.json Removes the location parameter and refreshes connection expressions.
infrastructure-setup-bicep/​01-connections/​connection-foundry.bicep Uses the group location and updates usage examples.
infrastructure-setup-bicep/​01-connections/​ai-gateway-tier/​main.bicep Uses the group location for Foundry while retaining the gateway region input.
infrastructure-setup-bicep/​01-connections/​ai-gateway-tier/​azuredeploy.json Refreshes account location settings and parameter descriptions.
infrastructure-setup-bicep/​00-basic/​main.bicep Uses the group location; adds region restrictions.
infrastructure-setup-bicep/​00-basic/​azuredeploy.json Refreshes generated location settings.

Review effort: Balanced

Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com>
Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com>
@deeikele

Copy link
Copy Markdown
Contributor Author

Copilot while you were reviewing i submitted a PR that should address part of comments. Take a look at those changes, then address all other recommendations you had.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Critical location-handling inconsistencies ignore explicit region overrides, creating account/project and private-endpoint/subnet regional mismatches that can cause deployment failures.

33 open issues

And 13 more that still need to be addressed.

2 previously missed issues

In code that hasn't changed since last review

Medium severity Purge ID uses var.location instead of the account region

infrastructure/​infrastructure-setup-terraform/​19-private-network-agent-setup-with-tools/​code/​main.tf:214

The account's region can now differ from var.location through either the override or an existing resource group, but the destroy-time purge ID at line 844 still uses var.location. The DELETE then targets the wrong regional deleted-account path, leaving the actual account unpurged and potentially blocking agent-subnet deletion. Use the same effective Foundry region in the purge ID without changing the destroy ordering.

Medium severity Purge targets the wrong regional account path

infrastructure/​infrastructure-setup-terraform/​48-bring-own-model-private-ca/​code/​foundry-agent.tf:42

The account now uses an override or the existing group's actual region, but purge_foundry_agent_account at line 95 still addresses locations/${var.location}. Whenever those regions differ, destroy targets the wrong deleted-account path instead of purging this account, so its service-association link can continue blocking subnet removal. Construct the purge ID using the same effective Foundry region and retain the current dependency ordering.

25 resolved since last review

And 5 more resolved.

Review effort: Balanced

name = "aifoundry${random_string.unique.result}"
parent_id = azurerm_resource_group.rg.id
location = var.location
location = coalesce(var.foundry_location, azurerm_resource_group.rg.location)
name = "aifoundry${random_string.unique.result}"
parent_id = azurerm_resource_group.rg.id
location = var.location
location = coalesce(var.foundry_location, azurerm_resource_group.rg.location)
Copilot AI balanced review requested due to automatic review settings November 13, 2026 05:37
Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com>

Copilot AI commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

Copilot while you were reviewing i submitted a PR that should address part of comments. Take a look at those changes, then address all other recommendations you had.

Reviewed the latest PR changes and addressed the remaining applicable location findings: East US 2 is accepted by the four Bicep samples and generated templates, the sample 10 private endpoint follows its VNet region, Terraform Search connection metadata uses actual Search locations, and agent samples now reject cross-region Foundry/VNet configurations before deployment. Bicep builds and parameter-file checks pass; Terraform CLI was unavailable locally. Commit: eaf4a24.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Copilot AI balanced review requested due to automatic review settings November 13, 2026 07:38
Set default region parameter for AI Gateway tier.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Change location parameter to use a specified parameter instead of the resource group location.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Updated the location property to use parameters instead of resource group location.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Changed location property to use parameters instead of resource group location.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot AI balanced review requested due to automatic review settings November 13, 2026 07:47

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Generated JSON templates diverge from their Bicep source, risking unsupported account-region changes on redeployment, while Terraform checks incorrectly reject valid deployments whose resource-group metadata region differs from the workload region.

5 open issues

Review effort: Balanced

"apiVersion": "2025-04-01-preview",
"name": "[variables('hubName')]",
"location": "[parameters('region')]",
"location": "[resourceGroup().location]",

This branch was successfully deployed

1 active deployment
L4-validation — b97ef2d7 Deployed Nov 13, 2026 by deeikele via trusted #985
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants