Repository navigation
Update Bicep and Terraform samples to create Foundry in resource group location - #1165
Dennis Eikelenboom (deeikele) wants to merge 23 commits into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Deployment-blocking regressions remain: the setup helper passes a removed location parameter, committed parameter files specify disallowed regions, and inconsistent resource locations cause provisioning failures.
35 open issues
Setup helper still passes the removed location parameter · New Sample parameter file uses a disallowed region · New Sample parameter file uses a disallowed region · New Sample parameter file uses a disallowed region · New Sample parameter file uses a disallowed region · New Project region can differ from its parent account · New Hub project can deploy outside its account's region · New Project region can differ from its parent account · New Project region can differ from its parent account · New Project location override can mismatch the account region · New Private endpoint location can differ from its VNet region · New Explicit location override can split Foundry from its subnet · New Location override can place the account outside the VNet region · New Account and injected VNet can end up in different regions · New Reject groups outside the extension's required region · New Location override can break co-regional agent provisioning · New Foundry and its injected subnet can deploy in different regions · New Project module can deploy outside its account's region · New Account and agent network can use different regions · New Project location override can mismatch the account region · New
And 15 more that still need to be addressed.
What changed in this PR
This PR updates the infrastructure samples so Foundry accounts use their resource group’s location, aligning account placement across Terraform, Bicep, and generated ARM templates.
Changes:
- Derives Foundry locations from resource groups, adding lookups for existing groups where needed.
- Adds region allowlists and updates Terraform defaults and example configurations.
- Refreshes generated deployment templates, including existing networking, authentication, and monitoring changes.
Paths below are relative to infrastructure/.
| File | Description |
|---|---|
infrastructure-setup-terraform/48-bring-own-model-private-ca/code/variables.tf |
Adds region validation; defaults to Sweden Central. |
infrastructure-setup-terraform/48-bring-own-model-private-ca/code/terraform.tfvars.example |
Updates the example region. |
infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-model.tf |
Uses the resolved resource-group location. |
infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf |
Uses the resolved resource-group location. |
infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/05-spoke-workload-project/foundry-account.tf |
Looks up the spoke group’s location. |
infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/04-hub-workload/foundry-account.tf |
Looks up the hub group’s location. |
infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/02-spoke-base/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/47-bring-your-own-models-platform-lob/01-hub-base/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/46-bring-your-own-models/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/46-bring-your-own-models/code/platform-foundry.tf |
Uses the platform group’s location. |
infrastructure-setup-terraform/46-bring-your-own-models/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/46-bring-your-own-models/code/development-foundry.tf |
Uses the development group’s location. |
infrastructure-setup-terraform/45-basic-agent-bing/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/45-basic-agent-bing/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/45-basic-agent-bing/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/41-standard-agent-setup/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/41-standard-agent-setup/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/41-standard-agent-setup/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/32-customer-managed-keys-user-assigned-identity/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/31-customer-managed-keys-standard-agent/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/30-customer-managed-keys/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/30-customer-managed-keys/code/main.tf |
Uses the resource-group location; normalizes formatting. |
infrastructure-setup-terraform/30-customer-managed-keys/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/25-entraid-passthrough/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/25-entraid-passthrough/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/25-entraid-passthrough/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/20-user-assigned-identity/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/20-user-assigned-identity/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/20-user-assigned-identity/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf |
Uses the resolved group location for Foundry and Search. |
infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/locals.tf |
Resolves new or existing group locations. |
infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/data.tf |
Adds an existing resource-group lookup. |
infrastructure-setup-terraform/18-managed-virtual-network/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/18-managed-virtual-network/terraform.tfvars.example |
Aligns the example with the UAE North default. |
infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/17-private-network-standard-user-assigned-identity-agent-setup/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/16-private-network-standard-agent-apim-setup-preview/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/15b-private-network-standard-agent-setup-byovnet/code/main.tf |
Looks up the group location for Foundry and Search. |
infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/15a-private-network-standard-agent-setup/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/11-private-network-basic-vnet/code/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/11-private-network-basic-vnet/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/10-private-network-basic/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/10-private-network-basic/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/10-private-network-basic/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/04-disable-local-auth/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/04-disable-local-auth/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/04-disable-local-auth/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/03-custom-dns/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/03-custom-dns/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/03-custom-dns/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/02-storage-speech-language/code/variables.tf |
Adds region validation; defaults to East US. |
infrastructure-setup-terraform/02-storage-speech-language/code/main.tf |
Uses the resource-group location for Foundry. |
infrastructure-setup-terraform/02-storage-speech-language/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/00-basic/code/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/00-basic/code/main.tf |
Uses the AzAPI resource group’s location. |
infrastructure-setup-terraform/00-basic/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-terraform/00-basic-azurerm/code/variables.tf |
Adds region validation. |
infrastructure-setup-terraform/00-basic-azurerm/code/main.tf |
Uses the AzureRM resource group’s location. |
infrastructure-setup-terraform/00-basic-azurerm/code/example.tfvars |
Updates the example to East US. |
infrastructure-setup-bicep/48-bring-own-model-private-ca/main.json |
Refreshes account locations and region restrictions. |
infrastructure-setup-bicep/48-bring-own-model-private-ca/main.bicep |
Places both accounts in the group’s region; adds an allowlist. |
infrastructure-setup-bicep/48-bring-own-model-private-ca/azuredeploy.json |
Refreshes the portal template’s location settings. |
infrastructure-setup-bicep/45-basic-agent-bing/main.bicep |
Passes the group location to Foundry; adds region restrictions. |
infrastructure-setup-bicep/45-basic-agent-bing/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/43-standard-agent-setup-with-customization/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/43-standard-agent-setup-with-customization/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/42-basic-agent-setup-with-customization/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/42-basic-agent-setup-with-customization/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/41-standard-agent-setup/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/41-standard-agent-setup/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/40-basic-agent-setup/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/40-basic-agent-setup/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/32-customer-managed-keys-user-assigned-identity/main.bicep |
Passes the group location to the account module. |
infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/31-customer-managed-keys-standard-agent/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/30-customer-managed-keys/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/30-customer-managed-keys/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/25-entraid-passthrough/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/20-user-assigned-identity/main.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/20-user-assigned-identity/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/20-user-assigned-identity/azuredeploy.json |
Refreshes the portal template’s location settings. |
infrastructure-setup-bicep/19-private-network-agent-tools/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/19-private-network-agent-tools/azuredeploy.json |
Refreshes location settings and dependency ordering. |
infrastructure-setup-bicep/18-managed-virtual-network/main.bicep |
Passes the group location to Foundry; adds region restrictions. |
infrastructure-setup-bicep/18-managed-virtual-network/azuredeploy.json |
Refreshes location settings and dependency ordering. |
infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/17-private-network-standard-user-assigned-identity-agent-setup/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.json |
Refreshes account placement and endpoint-region wiring. |
infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/main.bicep |
Uses group locations for accounts; restricts gateway resources to Sweden Central. |
infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/extensions/ai-gateway-tier-private/azuredeploy.json |
Refreshes account placement and gateway region restrictions. |
infrastructure-setup-bicep/16-private-network-standard-agent-apim-setup/azuredeploy.json |
Refreshes locations, caller-IP access, and endpoint parameters. |
infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/foundry-private-setup/assets/bicep/account.bicep |
Removes the location input; uses the group’s region. |
infrastructure-setup-bicep/15a-private-network-evaluation-only-setup/azuredeploy.json |
Refreshes account and private-endpoint location wiring. |
infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicep |
Updates allowed regions and account placement. |
infrastructure-setup-bicep/15-private-network-standard-agent-setup/azuredeploy.json |
Refreshes locations, authentication controls, and DNS input handling. |
infrastructure-setup-bicep/11-private-network-basic-vnet/modules-network-secured/ai-account-identity.bicep |
Replaces the location input with the group’s region. |
infrastructure-setup-bicep/11-private-network-basic-vnet/main.json |
Refreshes locations and includes private tracing resources. |
infrastructure-setup-bicep/11-private-network-basic-vnet/main.bicep |
Updates region restrictions and removes the account location argument. |
infrastructure-setup-bicep/11-private-network-basic-vnet/azuredeploy.json |
Refreshes locations and includes private tracing resources. |
infrastructure-setup-bicep/10-private-network-basic/main.json |
Refreshes locations, naming, networking, and project configuration. |
infrastructure-setup-bicep/10-private-network-basic/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/10-private-network-basic/azuredeploy.json |
Refreshes the portal template’s location settings. |
infrastructure-setup-bicep/04-disable-local-auth/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/04-disable-local-auth/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/03-custom-dns/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/03-custom-dns/azuredeploy.json |
Refreshes generated location settings. |
infrastructure-setup-bicep/02-storage-speech-language/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/01-connections/connection-foundry.json |
Removes the location parameter and refreshes connection expressions. |
infrastructure-setup-bicep/01-connections/connection-foundry.bicep |
Uses the group location and updates usage examples. |
infrastructure-setup-bicep/01-connections/ai-gateway-tier/main.bicep |
Uses the group location for Foundry while retaining the gateway region input. |
infrastructure-setup-bicep/01-connections/ai-gateway-tier/azuredeploy.json |
Refreshes account location settings and parameter descriptions. |
infrastructure-setup-bicep/00-basic/main.bicep |
Uses the group location; adds region restrictions. |
infrastructure-setup-bicep/00-basic/azuredeploy.json |
Refreshes generated location settings. |
Review effort: Balanced
Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com>
Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com>
|
Copilot while you were reviewing i submitted a PR that should address part of comments. Take a look at those changes, then address all other recommendations you had. |
There was a problem hiding this comment.
🟡 Changes recommended
Critical location-handling inconsistencies ignore explicit region overrides, creating account/project and private-endpoint/subnet regional mismatches that can cause deployment failures.
33 open issues
Account ignores the explicit location override · New Account ignores location override, splitting account and project regions · New Account and project use different regions when location is overridden · New JSON template drops the account module's location override · New Account and project use different regions when location is overridden · New Account and project use different regions when location is overridden · New Account module ignores the caller's location override · New Hub and consumer accounts ignore the region override · New Resource-group default can fail the supported-region constraint · New Account and project use different regions when location is overridden · New Account module ignores the caller's location override · New Account and project use different regions when location is overridden · New Account and project use different regions when location is overridden · New Account and project use different regions when location is overridden · New Account ignores the explicit location override · New Account ignores the explicit location override · New Account and project use different regions when location is overridden · New Account and project use different regions when location is overridden · New Account module ignores the caller's location override · New Account module ignores the caller's location override · New
And 13 more that still need to be addressed.
2 previously missed issues
In code that hasn't changed since last review

Purge ID uses var.location instead of the account region

infrastructure/infrastructure-setup-terraform/19-private-network-agent-setup-with-tools/code/main.tf:214
The account's region can now differ from var.location through either the override or an existing resource group, but the destroy-time purge ID at line 844 still uses var.location. The DELETE then targets the wrong regional deleted-account path, leaving the actual account unpurged and potentially blocking agent-subnet deletion. Use the same effective Foundry region in the purge ID without changing the destroy ordering.

Purge targets the wrong regional account path

infrastructure/infrastructure-setup-terraform/48-bring-own-model-private-ca/code/foundry-agent.tf:42
The account now uses an override or the existing group's actual region, but purge_foundry_agent_account at line 95 still addresses locations/${var.location}. Whenever those regions differ, destroy targets the wrong deleted-account path instead of purging this account, so its service-association link can continue blocking subnet removal. Construct the purge ID using the same effective Foundry region and retain the current dependency ordering.
25 resolved since last review
Setup helper still passes the removed location parameter Generated templates can deploy account and VNet in different regions Project module receives the wrong account region Project module receives the wrong account region Project location override can mismatch the account region Project module receives the wrong account region Project location override can mismatch the account region CMK update uses a different region from the account CMK update can redeploy the account in a different region Encryption update can attempt to move the account Project can deploy outside its parent account's region Project location override can mismatch the account region Account and agent network can use different regions Project module can deploy outside its account's region Foundry and its injected subnet can deploy in different regions Location override can break co-regional agent provisioning Reject groups outside the extension's required region Account and injected VNet can end up in different regions Location override can place the account outside the VNet region Explicit location override can split Foundry from its subnet
And 5 more resolved.
Review effort: Balanced
| name = "aifoundry${random_string.unique.result}" | ||
| parent_id = azurerm_resource_group.rg.id | ||
| location = var.location | ||
| location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) |
| name = "aifoundry${random_string.unique.result}" | ||
| parent_id = azurerm_resource_group.rg.id | ||
| location = var.location | ||
| location = coalesce(var.foundry_location, azurerm_resource_group.rg.location) |
Co-authored-by: deeikele <92387505+deeikele@users.noreply.github.com>
Reviewed the latest PR changes and addressed the remaining applicable location findings: East US 2 is accepted by the four Bicep samples and generated templates, the sample 10 private endpoint follows its VNet region, Terraform Search connection metadata uses actual Search locations, and agent samples now reject cross-region Foundry/VNet configurations before deployment. Bicep builds and parameter-file checks pass; Terraform CLI was unavailable locally. Commit: |
There was a problem hiding this comment.
🔵 Needs a closer look
Unresolved location regressions place Foundry accounts in different regions from their projects or VNets, causing deployment failures, while Terraform resource-group region checks reject valid configurations.
15 open issues
Injected account ignores region override Account module ignores the caller's location override Account module ignores the caller's location override Account and project use different regions when location is overridden Account and project use different regions when location is overridden Account ignores the explicit location override Account ignores the explicit location override Account and project use different regions when location is overridden Account and project use different regions when location is overridden Account module ignores the caller's location override Resource-group default can fail the supported-region constraint Resource-group region check rejects valid cross-region deployment Resource-group region check rejects valid cross-region deployment Purge targets the wrong regional account path Purge ID uses the wrong Foundry region
1 resolved since last review
Review effort: Balanced
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
Critical location-handling inconsistencies in generated templates cause account/project region mismatches and deployment failures for supported overrides, while Terraform validation also rejects valid configurations.
13 open issues
Account module ignores the caller's location override Account and project use different regions when location is overridden Account and project use different regions when location is overridden Account ignores the explicit location override Account ignores the explicit location override Account and project use different regions when location is overridden Account and project use different regions when location is overridden Account module ignores the caller's location override Resource-group default can fail the supported-region constraint Resource-group region check rejects valid cross-region deployment Resource-group region check rejects valid cross-region deployment Purge targets the wrong regional account path Purge ID uses the wrong Foundry region
2 resolved since last review
Review effort: Balanced
Set default region parameter for AI Gateway tier. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Change location parameter to use a specified parameter instead of the resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Updated the location property to use parameters instead of resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Changed location property to use parameters instead of resource group location. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
Account location overrides cause parent/project region mismatches and deployment failures in the JSON templates, while Terraform preconditions reject valid deployments when resource-group metadata and workload regions differ.
4 open issues
9 resolved since last review
Account module ignores the caller's location override Account and project use different regions when location is overridden Account and project use different regions when location is overridden Account ignores the explicit location override Account ignores the explicit location override Account and project use different regions when location is overridden Account and project use different regions when location is overridden Account module ignores the caller's location override Resource-group default can fail the supported-region constraint
Review effort: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
Generated JSON templates diverge from their Bicep source, risking unsupported account-region changes on redeployment, while Terraform checks incorrectly reject valid deployments whose resource-group metadata region differs from the workload region.
5 open issues
Review effort: Balanced
| "apiVersion": "2025-04-01-preview", | ||
| "name": "[variables('hubName')]", | ||
| "location": "[parameters('region')]", | ||
| "location": "[resourceGroup().location]", |

No description provided.